Most people assume that if a thief drains their checking or savings account, the bank will make it right. That is usually how it works. But some consumers discover something different: They report the theft to their bank, wait a week or two, and receive a letter saying the bank investigated, found no error, or concluded the customer authorized or participated in the transactions. The money is gone, and now the bank has effectively accused the customer of stealing their own money. Worse, the bank has now stated in writing the lie that the customer may have been involved in (and benefitted from) the fraud. And being labelled a participant in fraud by your own bank can affect employment and security clearances, not to mention creating fear of criminal prosecution.
But there is good news. The Electronic Fund Transfer Act (EFTA) and its implementing rule, Regulation E, gives consumers specific, enforceable rights when unauthorized electronic transfers hit their accounts, and they place meaningful obligations on the financial institution.
What EFTA Covers
EFTA applies to electronic transfers of money in and out of consumer accounts. That includes ATM withdrawals, debit card transactions, online transfers, direct deposits, and automatic bill payments. A transfer is “unauthorized” when someone other than the accountholder initiates it without authority, and the accountholder receives no benefit from it.
Card skimming is a common source of these claims. A skimmer is a disguised reader fitted over an ATM or gas pump card slot, usually paired with a hidden camera or an overlay on the keypad that captures the PIN. The device copies the data on the card’s magnetic stripe, and that data can be encoded onto a blank card to make a working counterfeit. The original card never leaves the consumer’s wallet. Cards with EMV chips are far harder to clone this way, because the chip generates a new code for every transaction. But there are still some Magnetic-stripe-only cards in circulation, and those cards are particularly susceptible to skimming.
This is worth emphasizing, because banks sometimes treat a consumer’s continued possession of the physical card as proof that the consumer must have made the withdrawals. With a cloned card that was skimmed, the whole point is that the card is still in the consumer’s possession.
Your Liability is Capped, and the Burden is on the Bank
Under the EFTA, a consumer’s liability for unauthorized electronic transfers is limited. When the consumer reports promptly, that liability generally may not exceed $50. Regulation E is also clear that a consumer’s alleged carelessness with the card, with the PIN, etc. does not affect the $50 cap. Liability turns on how quickly the loss was reported, not on whether the bank thinks the customer should have been more careful.
Second, when there is a dispute about whether a transfer was authorized, the burden of proof is on the financial institution to show that it was. The consumer does not have to prove a negative. The bank has to prove that the consumer authorized it.
The Bank Has to Investigate, and There is a Clock
Once a consumer gives notice of an error, the bank must investigate, determine whether an error occurred, and correct it promptly if one did. And it’s not just any investigation. The law requires a “reasonable investigation,” which usually means reviewing the transaction records, the account’s recent transaction history, and where the disputed transactions occurred relative to where the consumer lives and normally banks. And if the consumer supplies evidence to prove they were not the one who took out the money or authorized it, the bank has to review it as part of their investigation.
In general, they must complete their investigation within 10 business days, and report their results to the consumer within three business days after that.
The bank may choose to take up to 45 days to complete its investigation, but only if it provisionally credits the disputed amount to the consumer’s account within those first 10 business days.
Note that there is also a clock for the victim: the EFTA has a one year statute of limitations.
You Can Demand the Bank’s Documents
If the bank concludes no error occurred, its written explanation has to state the actual reasons for that finding, not just recite a conclusion. It also has to tell you that you may request the documents the bank relied on.
When you make that request in writing, the bank must produce them.
What to Do If Your Bank Denies Your Fraud Claim
- Report immediately, in writing. Use the bank’s secure message system if you have one, so there is a timestamp. Phone calls are fine, but follow up in writing.
- Keep a log. Dates, times, who you spoke with, what they said. Bank representatives sometimes volunteer useful admissions.
- File a police report and request the transaction details you need for it.
- Send the bank your evidence establishing that you were not the person who initiated the transfers.
- Request the investigation documents in writing under 12 C.F.R. § 1005.11(d)(1).
- Watch the calendar. Note when you gave notice, whether provisional credit ever appeared, and when the denial arrived. Denial letters sent by bulk mail can take a week or more to reach you.
- Save everything. Letters, envelopes, secure messages, statements.
How an EFTA Attorney Can Help
EFTA is a remedial statute, and it has teeth. Consumers who prevail may recover actual damages, statutory damages, and attorneys’ fees. Where a bank knowingly and willfully concludes there was no error when it could not reasonably have reached that conclusion on the evidence in front of it, the statute allows for treble damages on the amount of the error.
If your bank has denied a fraud claim, refused to issue provisional credit, ignored your request for documents, or accused you of authorizing transactions you never made, the law may be on your side. Contact our team for a review of your case.