Finding unexplained withdrawals, debit card charges, ACH debits, or payment app transfers in a bank account can feel disorienting fast. In a lot of situations, people are not only dealing with missing money — they’re also dealing with confusing bank letters, short deadlines, fraud departments, and questions about whether the loss counts as “unauthorized” under federal law.
This issue sits inside the broader world of consumer protection problems that can spiral into major financial disputes. And when bank fraud or a disputed transfer is involved, one of the most important legal frameworks is Regulation E, the federal rule implementing the Electronic Fund Transfer Act.
In this post you’ll learn what Regulation E covers, what “unauthorized transfer” usually means, how the error-resolution process works, where consumers often run into trouble, and why lost-funds disputes sometimes turn into legal claims.
<aside> 💡 Scroll to the bottom for every post in this series.
</aside>
Regulation E is the federal rule that governs many electronic fund transfers tied to consumer accounts, including things like debit card transactions, ATM withdrawals, ACH transfers, some payment app transactions, and other electronic debits or credits from a consumer bank account. The Consumer Financial Protection Bureau identifies consumer liability and error resolution as core parts of the rule, and the regulation appears in 12 C.F.R. Part 1005 under the Electronic Fund Transfer Act framework (CFPB overview, CFPB final rules page).
In practical terms, Regulation E is the set of rules that often matters when:
If you want the broader foundation first, it may help to start with a plain-English overview of bank fraud and transfer rights.
That question often drives the whole dispute.
Under Regulation E, not every bad transaction is automatically covered, but many are. A key issue is whether the transfer was actually authorized by the consumer, directly or indirectly. The CFPB has published guidance making clear that transfers can still be treated as unauthorized even when a scammer tricked the consumer into giving up account credentials or a one-time security code. In one CFPB FAQ example, a fraudster pretends to be from the consumer’s financial institution and tricks the consumer into sharing login information, card information, or a texted confirmation code; the CFPB explains that those subsequent transfers can still qualify as unauthorized EFTs (CFPB FAQ).
That point matters because banks sometimes frame these disputes as “customer participated” cases. In general terms, the legal analysis is often more specific than that. A person can be manipulated, deceived, or socially engineered without actually authorizing the transfer in the way Regulation E uses that concept.
Examples that may fall within unauthorized EFT disputes include: