Your liability depends on when you report the fraud and which bank you use

You are not liable for fraudulent transfers from your checking account if you report them to your bank within the timeframe your bank requires. Federal law under Regulation E limits your liability to zero dollars if you report within two business days of discovering the fraud. If you wait longer, your liability can climb to $500 or more, depending on how long you delay and which transactions the fraudster completed.

The key is speed. The moment you notice unauthorized transactions—whether that's a missing debit card, a strange login, or money gone from your account—contact your bank by phone. Do not email or use the bank's website chat. Call the number on the back of your card or in your account statements, because that number connects you to the real bank, not a fraudster's fake site.

Key Takeaways

  • Report fraud to your bank within two business days to avoid any liability for unauthorized transfers.
  • If you report between two and 60 days after discovering the fraud, you may be liable for up to $500 of the loss.
  • After 60 days, you could lose the entire amount stolen, though most banks cover losses beyond that window as a customer service practice.
  • Call your bank's fraud line immediately using the number on your card or statement—do not use a number from an email or text message.
  • Your bank must investigate and return your money within 10 business days if the fraud is confirmed.

How the two-day window works

Regulation E, enforced by the Consumer Financial Protection Bureau, sets the standard that protects you. If you tell your bank about unauthorized transactions within two business days of discovering them, the bank must treat the loss as their problem, not yours. You owe nothing.

The clock starts when you discover the fraud, not when it happened. If a fraudster drained your account on a Friday night but you did not check your balance until Monday morning, your two-day window runs from Monday. Weekends and holidays do not count as business days, so if you discover fraud on a Friday evening, you have until Monday to call.

Most banks also offer online fraud reporting through their secure website or app, but calling is faster and creates a clear record of when you reported it. Write down the date and time you called, the name of the person you spoke with, and the confirmation number they give you.

What happens if you report after two days but within 60 days

If you report the fraud between two and 60 days after discovering it, your bank can hold you liable for up to $500 of the unauthorized transfers. This is the middle ground: you are not on the hook for the full amount, but you are not fully protected either.

Your bank will still investigate and may cover more than $500 depending on their own policies, but they are not required to by law. Some banks cover all losses as a customer retention practice; others enforce the $500 cap strictly. Check your account agreement or call your bank's customer service line to learn their specific policy.

The $500 limit applies per account, not per transaction. If a fraudster made ten $100 transfers, your liability is capped at $500 total, not $500 per transfer.

Your liability after 60 days

If you do not report the fraud until after 60 days have passed, you could be liable for the entire amount stolen. Regulation E no longer protects you, and your bank has no legal obligation to refund anything.

However, most banks still cover losses beyond 60 days if you can show you had a legitimate reason for the delay—illness, travel, or a compromised email account that prevented you from seeing statements. Document whatever prevented you from noticing sooner and explain it to your bank in writing. Send the letter to the address on your statement marked "Fraud Department" or "Disputes," and keep a copy for yourself.

Banks also sometimes cover older fraud if the fraudster used your account repeatedly over months and you reported as soon as you noticed the pattern. The bank may decide it is cheaper to refund you than to defend a dispute, especially if the total is small.

How banks investigate and what they need from you

Once you report fraud, your bank opens an investigation and must complete it within 10 business days. During that time, they will contact you if they need more information—usually a signed affidavit stating that you did not authorize the transactions.

Prepare to provide: the dates of the unauthorized transactions, the amounts, and the merchant names if you recognize them. If the fraudster used your debit card number online or in person, describe how you think they got it—a data breach, a phishing email, a lost card. If they logged into your online banking, tell the bank whether you use the same password elsewhere or if your email account was compromised.

The bank will also check whether you received any alerts or notifications about the transactions. If you ignored a text message warning you about a large transfer, that can complicate your case, though it does not automatically disqualify you from protection.

What to do while the investigation is underway

Your bank must provisionally credit your account—return the money to you—within one to three business days while they investigate, though some banks do this immediately. You can use that money while the bank confirms the fraud. If the investigation later determines the transactions were actually authorized, the bank will remove the credit and you will owe it back.

Change your online banking password immediately, using a password you have never used before. If you use the same password on other accounts, change those too. Enable two-factor authentication on your bank account if you have not already—this requires a code from your phone or email in addition to your password when you log in.

If your email account was compromised, change that password as well and review the recovery email and phone number on file. A fraudster with access to your email can reset passwords on any account linked to it, including your bank.

Monitor your credit report for new accounts opened in your name. You can check for free at annualcreditreport.com, which is the official site run by the three major credit bureaus. If you see accounts you did not open, contact the bureau and the creditor immediately.

Debit card fraud versus online banking fraud

The rules are the same whether a fraudster stole your debit card number or hacked your online banking login, but the investigation path differs slightly. With a stolen card number, the bank checks whether the merchant processed the transaction and whether you were in that location at the time. With online banking fraud, the bank reviews login records, IP addresses, and device information to determine whether the access was authorized.

Online banking fraud is often easier to prove because the bank has a clear record of which device logged in and from where. If you logged in from your home in Ohio but the fraudster logged in from an IP address in Russia, that is strong evidence of unauthorized access. Card fraud is harder to prove if you cannot show you were nowhere near the merchant location.

In both cases, the bank's investigation is the same: they confirm the fraud, credit your account, and close the case. Your liability timeline and caps remain identical.

Frequently Asked Questions

Can my bank refuse to refund me if I was careless with my password?

No. Regulation E protects you regardless of how the fraudster got your information. Even if you wrote your password on a sticky note or used "password123," your bank cannot deny your claim based on negligence. The bank's only defense is proving you authorized the transactions yourself.

What if the fraudster transferred money to another account and it is already gone?

Your bank still refunds you. They pursue the receiving bank to recover the money, but that is their problem, not yours. You get your money back within the investigation period regardless of whether the receiving bank cooperates. The bank may take weeks or months to recover the funds from the other institution, but you are made whole immediately.

Do I need to file a police report to get my money back?

No. A police report is not required by Regulation E and does not speed up your bank's investigation. File one if you want a record for your own purposes or if the fraud involved identity theft, but your bank will refund you based on their own investigation alone.

What if my bank says I am liable because I did not use two-factor authentication?

Push back. Regulation E does not require two-factor authentication, and banks cannot impose it as a condition of fraud protection. If your bank refuses to refund you on those grounds, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov or call 855-411-2372.

Can I be liable if someone hacked my email and used it to reset my bank password?

No. The bank still refunds you because you did not authorize the transactions, even though the fraudster had access to your email. Report both the email compromise and the bank fraud to your bank and your email provider. Your bank will investigate the login records and see that the password reset came from an unfamiliar device or location.