How long do I have to report an unauthorized transfer under Regulation E?

A notice of error must reach the bank no later than 60 days after the bank sends the periodic statement on which the alleged error first appears, under 12 CFR 1005.11(b)(1). Separately, consumer liability under 12 CFR 1005.6 is capped at $50 if the consumer notifies the bank within two business days after learning of the loss or theft of an access device, and up to $500 otherwise, with further liability possible for transfers after the 60-day statement period if notice is late. Report immediately; do not wait for either clock.

Authorized Debit Scam: Reg E's Gap

The gap in one paragraph The test: who actually initiated the transfer? The clocks that apply to unauthorized claims only The exception: tricked into handing over access The exception that is not a law: Zelle's imposter-scam policy What to do when the bank says "you authorized it" What this guide cannot promise FAQ

The gap in one paragraph

A caller pretending to be from your bank warns you that your account is under attack and tells you to move your money to a "safe account" with Zelle. You send it. The money is gone, the "safe account" belonged to a scammer, and your bank tells you: you authorized it, so there is nothing to reimburse. That answer feels wrong, and for most victims it is also the end of the legal road under Regulation E — the federal rule that governs electronic fund transfers from consumer accounts. Regulation E's reimbursement duty attaches to unauthorized transfers. A transfer you personally initiated and authorized is not an unauthorized transfer, even when every word that persuaded you to send it was a lie. This guide explains that distinction, the one important exception that can flip the answer, and the steps that are still worth taking after a denial.

Do not wait to read the whole guide before acting. Contact your bank and the payment app immediately, preserve every message and receipt, and ask whether anything can still be held or recalled. The steps below explain what to say and what to ask for.

The test: who actually initiated the transfer?

Regulation E, at 12 CFR 1005.2(m), defines an unauthorized electronic fund transfer as a transfer from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit. And 12 CFR 1005.11(a)(1)(i) treats an unauthorized transfer as an "error" that triggers the bank's error-resolution duties. A transfer the consumer authorized is not an error on that ground, so the error-resolution and liability protections in 12 CFR 1005.11 and 1005.6 do not compel reimbursement for it. Everything turns on one question: who pressed send?

What happened	Who initiated it?	Regulation E treatment
You sent a Zelle, Venmo or Cash App payment to a scammer after being lied to about who they were or what the payment was for	You	Authorized. No Regulation E reimbursement right, even though you were deceived.
A scammer used login details or a code you were tricked into sharing to send a payment out of your account themselves	The scammer	Unauthorized. See the code-handover exception below.
Someone stole your card or phone and sent a payment without your involvement	Someone else	Unauthorized. Report it as an unauthorized transfer immediately.

The distinction is harsh by design: the law protects you when someone else moves your money, but it does not insure you against being persuaded to move it yourself. Banks sometimes apply that line too broadly, though — including to cases that belong on the unauthorized side. That is why the exact facts of how the money moved matter more than the bank's first label for the case.

The clocks that apply to unauthorized claims only

These clocks are the reason speed matters for an unauthorized claim. They do not create a deadline for getting an authorized transfer refunded, because Regulation E gives no such refund right. Do not let a bank's "you authorized it" answer make you miss them if your case is in fact unauthorized.

Clock	What the rule says
60 days from the statement, not the transfer	Under 12 CFR 1005.11(b)(1), a notice of error must reach the bank no later than 60 days after the bank sends the periodic statement on which the alleged error first appears. Count from the statement date, and include your name, account number, and why you believe an error exists, with the type, date and amount where possible.
$50 / $500 liability tiers	Under 12 CFR 1005.6(b), if you notify the bank within two business days after learning of the loss or theft of an access device, your liability for an unauthorized transfer is capped at $50. Otherwise it can reach $500, and if you fail to report a transfer shown on a periodic statement within 60 days of the statement being sent, you can face liability for later transfers that would not have occurred had you reported in time.
Investigation and provisional credit	Under 12 CFR 1005.11(c), the bank must investigate promptly, generally determining whether an error occurred within 10 business days, or within 45 days if it provisionally credits your account within 10 business days. If the bank determines no error occurred, it must give you a written explanation and note your right to request the documents it relied on.

Two further points from the CFPB's guidance help if a bank tries to slow-walk an unauthorized claim: the bank must begin its investigation promptly on receiving an oral or written notice of error and may not delay it pending information from you, and the bank's own negligence rules do not let it raise your liability above Regulation E's limits just because you were careless. Those points apply to unauthorized transfers only — they do not turn an authorized payment into an unauthorized one.

The exception: tricked into handing over access

This is the exception most victims miss, and the one most worth checking before accepting a denial. The CFPB's Electronic Fund Transfers FAQs state that when a consumer is fraudulently induced into sharing account access information with a third party, and the third party uses that information to make a transfer from the consumer's account, the transfer is an unauthorized transfer under Regulation E. Comment 1005.2(m)-3 says the same thing in regulatory form: an unauthorized transfer includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery.

The CFPB's own examples make the line concrete. A caller pretending to be a representative from the consumer's bank who tricks the consumer into providing account login information, a texted account confirmation code, a debit card number, or other information that could be used to initiate a transfer — and then uses it — has carried out an unauthorized transfer. So has a fraudster who uses phishing to watch the consumer enter login information and then moves money with it. The CFPB also confirms that a consumer fraudulently induced into providing account information in this way has not "furnished an access device" under Regulation E, so the bank cannot use the furnished-access exclusion to deny the claim on that basis alone.

Put it as a single test: did you hand over the keys, or did you hand over the money? If you handed over a login, a code or card details because you were deceived, and the scammer then moved the money, frame your claim as an unauthorized transfer and say so explicitly — "the transfer was initiated by a third party who obtained my access information through fraud" — rather than as a scam you fell for. If you personally sent the payment, even to an account the scammer controlled, that is the authorized side of the line, and the next section is your remaining route. A bank must still investigate an unauthorized claim on its facts; calling it unauthorized does not automatically win it, but mislabeling it as authorized guarantees the wrong process.

The exception that is not a law: Zelle's imposter-scam policy

There is one widely reported route for authorized Zelle payments that does not come from Regulation E at all. Early Warning Services, the operator of Zelle, stated: "As of June 30, 2023, our bank and credit union participants must reimburse consumers for qualifying imposter scams, like when a scammer impersonates a bank to trick a consumer into sending them money with Zelle." It described the change as going beyond legal requirements. That framing matters: this is a network policy, not a legal right. You cannot enforce it as a Regulation E claim, and it covers only qualifying imposter scams.

Just as important, the qualifying criteria have not been published, and reporting on the policy notes that it is unclear how Zelle determines whether a scam refund claim is legitimate. So do not argue this policy as if it had a published checklist. Instead, ask your bank directly and in writing whether your transfer was reviewed as a qualifying imposter scam under the Zelle network policy that took effect June 30, 2023, and ask for the reason if it was found not to qualify. A bank that only answered the Regulation E question has not necessarily answered the policy question. This guide makes no equivalent claim for Venmo or Cash App: do not assume either app has the same policy. Use the app-specific checkers below to work through the route for the app you actually used.

What to do when the bank says "you authorized it"

Work through these in order, and keep a copy of everything:

1. Get the denial in writing, with its reason. Ask for a written explanation of the bank's findings and for the documents it relied on — Regulation E requires that written explanation when a bank determines no error occurred. A phone "you authorized it" is not enough to work from; the specific reason tells you whether the bank decided the wrong question.
2. Re-frame the claim if the facts fit the unauthorized side. If the scammer initiated the transfer using login information, a texted confirmation code or card details you were tricked into sharing, say so in those words and ask the bank to investigate it as an unauthorized transfer under Regulation E, citing the CFPB's FAQs. If you personally sent the payment, say so honestly and move to step 3 — a mislabeled claim wastes the time you need for the real routes.
3. For Zelle, ask for the imposter-scam policy review by name. Ask whether the transfer was reviewed as a qualifying imposter scam under the Zelle network policy in effect since June 30, 2023, and what made it qualify or not. For the app you used, run the matching checker: Zelle Dispute Checker, Venmo Dispute Path Checker, Cash App Dispute Checker, or the P2P Scam Recovery Navigator if more than one route could apply.
4. File a CFPB complaint. If the bank's answer does not hold up — for example, it treated a code-handover case as authorized, or it never addressed the Zelle policy — file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint (or by phone at (855) 411-2372). Explain what happened, what you asked for, and what the bank answered. A complaint does not guarantee reimbursement, but it creates a tracked record and a formal company response.
5. Report the fraud to the FTC and to IC3. Report to the Federal Trade Commission at ReportFraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov. These reports help law enforcement spot patterns and do not themselves refund your money — file them alongside the bank and CFPB steps, not instead of them.
6. Complain to your state attorney general. Your state attorney general's consumer-protection office takes complaints about deceptive practices and about companies operating in your state. Include the same evidence packet: dates, amounts, messages, the bank's written denial, and your CFPB complaint details.
7. Preserve the evidence packet. Save the scammer's messages and phone numbers, the payment receipts and transaction IDs, your bank statements, and every message with the bank and the payment app. If anyone now offers to recover your money for an upfront fee, walk away — recovery-fee offers aimed at recent scam victims are a classic second scam.

If the bank denied a different kind of dispute, or you are unsure whether your case is authorized or unauthorized at all, read Regulation E debit disputes, paid a scammer: what to do, and dispute denied: what to do, and see how to file a CFPB complaint before you submit.

What this guide cannot promise

Honesty about the limits is the point of this guide. Regulation E does not promise reimbursement for a payment you authorized, Zelle's policy does not promise reimbursement for every imposter scam, and a CFPB, FTC or IC3 filing does not itself put money back in your account. Credit-card chargeback rules are a different system and do not apply to a debit or peer-to-peer payment just because the loss feels the same. What you can still control is the framing of the claim, the speed of your reports, the written record, and whether every available review — Regulation E, the Zelle policy, the CFPB, and your state attorney general — was actually asked for. If none of them produces a refund, that is the gap this guide is named for, and it is worth naming plainly rather than softening with a promise no source supports.

FAQ

Under Regulation E, if you personally initiated and authorized the transfer, the bank has no Regulation E duty to reimburse it, even if you were deceived about who or what you were paying. But check two things before accepting that answer: whether the scammer, not you, initiated the transfer using access information you were fraudulently induced to share, which the CFPB treats as unauthorized, and, for Zelle, whether the bank reviewed the transfer under the network's qualifying imposter-scam policy.

The CFPB's Electronic Fund Transfers FAQs say that when a consumer is fraudulently induced into sharing account access information and a third party uses that information to make a transfer from the consumer's account, the transfer is an unauthorized transfer under Regulation E. Its examples include a caller pretending to be from the consumer's bank who tricks the consumer into providing login information, a texted account confirmation code, or a debit card number. That is different from personally sending a payment to a scammer yourself.

A notice of error must reach the bank no later than 60 days after the bank sends the periodic statement on which the alleged error first appears, under 12 CFR 1005.11(b)(1). Separately, consumer liability under 12 CFR 1005.6 is capped at $50 if you notify the bank within two business days after learning of the loss or theft of an access device, and up to $500 otherwise, with further liability possible for transfers after the 60-day statement period if notice is late. Report immediately; do not wait for either clock.

No. Since June 30, 2023, Early Warning Services, the operator of Zelle, has required its bank and credit union participants to reimburse consumers for qualifying imposter scams, which it describes as going beyond legal requirements. It is a network policy, not a legal right under Regulation E, it covers only qualifying imposter scams, and the qualifying criteria have not been published, so a bank's review under the policy is case-specific.

Authorized Debit Scam — Reg E's Missing-Protection Gap

On this page