Finding unauthorized transfers in your bank account or payment app can feel surreal. One minute your balance looks normal. The next, money is gone, customer support is pointing fingers, and the answers sound vague: investigation pending, transaction authorized, nothing we can do.
That confusion is common. It is also one reason payment disputes have become such a major consumer issue. The Federal Trade Commission reported that consumers lost $12.5 billion to fraud in 2024, and losses tied to bank transfers and payments were among the highest reported payment methods (FTC, FTC Data Book). At the same time, federal law gives consumers important protections for many unauthorized electronic fund transfers, especially under the Electronic Fund Transfer Act and Regulation E (CFPB Regulation E).
If you are trying to understand the bigger picture first, it may help to start with this overview of unauthorized use, investigation rights, and reimbursement issues in debit card and payment app disputes.
In this post you’ll learn the answers to eight of the most common questions people ask when a bank, fintech, or payment app refuses to fix a fraud problem.
<aside> 💡 Scroll to the bottom for every post in this series.
</aside>
This is often the first and most frustrating response consumers hear.
In general terms, banks and apps frequently deny claims by arguing that the transaction was “authorized” because the login credentials, device, passcode, debit card, or authentication method connected to the account was used. But that is not always the end of the story under federal law.
Under Regulation E, an unauthorized electronic fund transfer generally means a transfer from a consumer’s account initiated by someone other than the consumer without actual authority and from which the consumer received no benefit (CFPB official interpretation). The CFPB has also explained in its Electronic Fund Transfers FAQs that private network rules or account agreements cannot take away consumer protections provided by federal law (CFPB FAQs).
That matters because companies sometimes blur two very different situations:
Those categories can lead to different legal arguments, and disputes often turn on very specific facts: who initiated the transfer, how access was obtained, whether credentials were stolen, whether the payment app acted only as a service provider, and which institution actually held the account.
Here’s what this often means in practice: when a bank says “authorized,” it may be making a factual conclusion that is incomplete, too broad, or based mainly on device and login data. An attorney might help evaluate whether that conclusion lines up with the actual rules that apply to the transfer.
Not always immediately, and not in every scenario, but consumers often have more protection than the initial denial suggests.
For many unauthorized electronic fund transfers, Regulation E limits a consumer’s liability if the consumer gives timely notice. The CFPB’s current rule explains that liability can depend on how quickly the loss is reported and whether the transfer appeared on a periodic statement (CFPB § 1005.6). If the unauthorized transfer appeared on a statement, the consumer generally has 60 days from transmittal of that statement to report it and preserve protection against later unauthorized transfers (CFPB § 1005.6).
Banks also have error-resolution duties. Under Regulation E, if a financial institution cannot complete its investigation within 10 business days, it may take up to 45 days in many cases, but it generally has to provisionally credit the consumer’s account within the initial 10-business-day period while the investigation continues (CFPB § 1005.11).
That is one reason consumers are often surprised when they hear, “We’re still investigating, so no credit yet.” In some situations, the law may require more than a generic delay.