The short version
- Regulation E defines an unauthorised transfer as one "initiated by a person other than the consumer without actual authority" and from which the consumer receives no benefit. A payment you keyed in yourself is not that, however you were persuaded to key it in.
- Where the transfer is unauthorised, 12 CFR 1005.11 gives the bank 10 business days to decide — or up to 45 days if it provisionally credits your account within those 10 business days and lets you use the money.
- Your notice must reach the bank no later than 60 days after it sends the statement the transfer first appears on. Under 12 CFR 1005.6 the amount you can be left carrying is $50, $500 or unlimited, depending on how fast you report.
- If a fraudster obtained your login, card or one-time code and moved the money themselves, the official commentary treats that as unauthorised — a device obtained by fraud or robbery does not become authorised.
Two people lose the same $4,000 in the same week. One had her banking credentials phished and watched a stranger empty the account. The other was talked through the transfer by a caller claiming to be the fraud team, and pressed send herself. Their banks will treat those claims completely differently, and the reason is one definition neither has read.
What "unauthorised" means in the regulation
Regulation E, at 12 CFR § 1005.2(m), defines an unauthorised electronic fund transfer as one "from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit". The first limb decides most disputes: somebody other than you has to have initiated it.
That is broader than banks sometimes suggest. An "access device" under § 1005.2(a)(1) is "a card, code, or other means of access to a consumer's account" — equally a password or a one-time passcode. And comment 2(m)-3 is explicit: an unauthorised transfer "includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery". Reading out a code you were tricked into disclosing does not make the fraudster's transfer your own.
The only question the definition asks
Who put the instruction into the app?
Someone else did
Unauthorised under § 1005.2(m), including where they got your card or passcode by fraud. The § 1005.11 machinery applies and the bank carries the burden of proving otherwise.
You did, having been deceived
You initiated it and had authority over your own account. Generally treated as authorised, so the clock and the provisional credit never start.
Why a transfer you were tricked into sending falls outside
If you initiated the payment, the first limb of § 1005.2(m) fails on its own terms and the exclusions further down are never reached — so it is not an error under § 1005.11(a)(1)(i). Nor is it an "incorrect electronic fund transfer" under § 1005.11(a)(1)(ii): the bank moved the exact amount you specified to the exact recipient you specified. Its execution was correct; your instruction was procured by a lie. Regulation E polices the first of those and says nothing about the second.
The clock that starts once the transfer is unauthorised
On the other side of the line, Regulation E is unusually prescriptive. Section 1005.11(b)(1) requires your notice to reach the institution no later than 60 days after it sends the periodic statement on which the error first appears — not 60 days from the transfer, which is a different and usually later date. Notice may be oral or written, and comment 11(b)(1)-1 confirms it works even without an account number so long as the bank can identify the account.
What the bank owes you, and when
Day 0
Notice of error received
Due within 60 days of the statement being sent. Everything below runs from this date.
10 business days
Decide, or credit and keep going
The bank decides — or provisionally credits the disputed amount, less at most $50, and takes up to 45 days.
+2 business days
Tell you about the credit
Confirm the amount and date, and give you full use of the funds while it investigates.
45 days
Investigation ends
Results reported within three business days of completion; a confirmed error corrected within one.
The provisional credit is the part worth knowing by heart. It is the only point where the money comes back before anyone has decided anything, and it is not discretionary: under § 1005.11(c)(2) a bank that wants the longer window has to credit the account within 10 business days to get it.
How fast you report changes what you are left carrying
Section 1005.6 caps your exposure, and it is the most actionable thing in the regulation because reporting speed is the one variable still under your control.
| When you notify | Your liability is capped at | The condition attached |
|---|---|---|
| Within two business days of learning of the loss | The lesser of $50 or the transfers made before notice | Comment 6(b)(1)-3: the two days exclude the day you found out and run as 24-hour periods, whatever the branch hours |
| After two business days, within 60 days of the statement | The lesser of $500, or $50 plus what was taken after the two days ran out | The bank must establish the later transfers would not have happened had you notified in time |
| More than 60 days after the statement was sent | Unlimited, for transfers after the 60 days closed | Again only where the bank establishes timely notice would have prevented them |
What a written notice of error has to contain
Phone the fraud line first: § 1005.6(b)(5) treats notice as given the moment you take the steps reasonably necessary to pass on the information, and the liability tiers run while you decide what to write. Section 1005.11(b)(1) then requires three things of the letter — enough to identify you and the account, why you believe an error exists, and the type, date and amount of each disputed transfer so far as you can supply them.
- 1
Report it by phone the day you learn of it
Use the number the bank discloses for error notices — comment 11(b)(1)-6 lets it insist on that channel. Note the date, the time and who you spoke to. This is the notice that caps your liability.
- 2
Ask for the confirmation address, then write within 10 business days
Section 1005.11(b)(2) lets a bank demand written confirmation of an oral notice inside 10 business days, but only if it says so and gives the address on the call. Send it by a method that produces a delivery record.
- 3
Diary the tenth business day from the notice
By then the bank must either have decided or have provisionally credited the account. If neither has happened, say so in writing that day and cite § 1005.11(c)(2).
- 4
If the answer is "no error", request the documents
Section 1005.11(d)(1) requires the written explanation to note your right to the documents the bank relied on, and requires copies promptly on request.
Put the notice of error in writing
Free full text. A dated notice naming the account, the transfers and the date you learned of them turns a phone call into something the bank has to answer on a clock.
If the investigation comes back "no error"
A denial is not the end of the regulation. EFTA § 1693g(b) puts the burden of proof on the institution "to show that the electronic fund transfer was authorized", so a denial resting on nothing but a login record is an assertion rather than a finding — and the documents you requested are how you test it.
Where to go after the denial, cheapest first
- Free
Request the documents
Section 1005.11(d)(1). What comes back is often thinner than the denial implied.
- Free
Escalate in writing
Name the section, the notice date and the missed deadline. Under § 1005.11(e) a bare repeat of a claim already handled properly achieves nothing.
- Free
Complain to the regulator
The bank's federal or state supervisor, plus the CFPB complaint database.
- Often contingent
Consumer lawyer under the EFTA
Fee-shifting is why a claim too small for an hourly retainer is still worth a call.
Most claims end on the first two rungs, and almost all turn on whether the deadlines were logged at the time rather than reconstructed afterwards.
A bank's scam policy is not the same thing as an entitlement
Since mid-2023 the banks and credit unions on the Zelle network have operated a rule requiring reimbursement for qualifying imposter scams — the caller pretending to be your bank, a government agency or a service provider. Real money has been refunded under it, and it is worth naming explicitly when you report a scam that fits. But a network rule between private institutions carries no statutory deadline, no provisional credit, no duty to explain a refusal in writing, no right to the underlying documents and no burden of proof on the bank. Regulation E has all five. When a policy says no the conversation is over; when the regulation says no you can go and read the section it said no under.
Mistyping the number is a different problem again
Keying a digit wrong is neither of the cases above. Nobody defrauded you and the bank did nothing incorrect; the money is simply sitting with a stranger who has no right to it, and speed is the whole remedy. Where the recipient is not enrolled or the details do not match, the transfer often has not been released and the provider can stop or correct it — the CFPB's guidance is to contact the provider immediately and ask. Once it settles, the claim is against the recipient as an ordinary debt: a demand letter, then small claims if it is ignored. The obstacle is identification — you may know only a phone number, and the provider will not release the rest without a subpoena.
The part that is genuinely unsettled
Whether induced transfers *should* fall inside Regulation E is contested, and it has moved in both directions inside two years. In December 2024 the CFPB sued Early Warning Services, the operator of Zelle, together with three of its owner banks, over losses from induced fraud. On 4 March 2025 the Bureau dismissed that case with prejudice. In August 2025 the New York Attorney General filed her own action against Early Warning Services under state law.
Nothing in that sequence changed the text of § 1005.2(m) or the timelines in § 1005.11. It is a fight about what the rule ought to cover, conducted while the rule sits where it has sat since 2011, and anyone predicting how it lands is guessing.
Which leaves the unglamorous posture. If somebody else moved the money you are not asking for goodwill — you are invoking a section with dates in it, and those dates run from your notice, not the bank's convenience. If you moved it yourself, the regulation is not your route, and the hours are better spent on the receiving bank, the network's scam rule and the recipient. Either way the record that decides it is made in the first forty-eight hours: when you learned of the loss, the time of the call, a dated written notice, and the tenth business day logged in the deadline tracker beside them.
Sources
- 12 CFR § 1005.2 — definitions, including "unauthorized electronic fund transfer" — Cornell LII
- 12 CFR § 1005.6 — consumer liability for unauthorized transfers — Cornell LII
- 12 CFR § 1005.11 — procedures for resolving errors — Cornell LII
- Supplement I to Part 1005 — official interpretations — Cornell LII
- 15 U.S.C. § 1693f — error resolution and treble damages — Cornell LII
- 15 U.S.C. § 1693g — consumer liability and burden of proof — Cornell LII
- 15 U.S.C. § 1693m — civil liability, statutory damages and fees — Cornell LII
- CNBC — CFPB drops its Zelle lawsuit, 4 March 2025
- NBC News — Zelle banks begin refunds for imposter scams
- NY Attorney General — action against Early Warning Services, August 2025
- CFPB — money sent where the recipient information did not match
General information, not legal advice. This guide explains how these documents and rules generally work. Law varies by jurisdiction and changes, and none of it is applied to your circumstances here. For anything consequential, consult a licensed attorney where you are.
Frequently asked
My bank says the Zelle transfer was authorised. Is that right?
Usually, if you keyed the payment in yourself. Regulation E defines an unauthorised transfer at 12 CFR 1005.2(m) as one initiated by a person other than the consumer without actual authority, from which the consumer receives no benefit. A payment you initiated does not meet that, however you were deceived into making it. If a fraudster obtained your card, password or one-time code and moved the money themselves, that is a different case and the bank is wrong.
How long does a bank have to investigate a disputed transfer?
Ten business days from receiving your notice of error to determine whether an error occurred. It may take up to 45 days instead, but only if it provisionally credits the disputed amount within those 10 business days and gives you full use of the funds. Ninety days replaces 45 where the transfer was a point-of-sale debit card transaction, was not initiated within a state, or happened within 30 days of the account's first deposit.
When does the 10-business-day provisional credit apply?
Where the bank cannot finish its investigation inside 10 business days and wants the longer window. Under 12 CFR 1005.11(c)(2) it must then credit the alleged error amount within 10 business days, tell you the amount and date within two business days of doing so, and let you use the money. It may withhold up to $50, and it need not credit at all if it required written confirmation of an oral notice and did not receive it in time.
What is the deadline for telling my bank about an unauthorised transfer?
No later than 60 days after the bank sends the periodic statement on which the transfer first appears — not 60 days from the transfer itself. Report far sooner than that: 12 CFR 1005.6 caps your liability at the lesser of $50 or the amount taken if you notify within two business days of learning of the loss, and at $500 if you do not.
I sent money to the wrong person by mistake. Can I get it back?
Not through the error-resolution rules, because the bank executed your instruction correctly. Contact the provider immediately — if the recipient is not enrolled or the details do not match, the funds may not have been released and the transfer can often be stopped or corrected. Once settled, the claim is against the recipient as an ordinary debt, and the practical difficulty is identifying someone you know only by a phone number.