Seeing money leave your account without your permission can feel surreal. One minute your debit card or payment app looks normal, and the next minute there is a transfer, card charge, cash-out, or purchase you do not recognize. For a lot of people, the confusion gets worse when the bank or app starts using phrases like “authorized,” “error resolution,” or “investigation pending.”
The good news is that federal law gives consumers important protections in many unauthorized electronic payment situations. Those protections often apply not only to traditional debit card fraud, but also to certain payment app transfers and wallet-based transactions. The hard part is figuring out which rules apply, who has to investigate, and what kind of notice matters.
In this post you’ll learn what an unauthorized transaction claim is, how debit card and payment app disputes often work, what Regulation E generally covers, how timing can affect liability, what banks and apps may be required to do during an investigation, and when attorney involvement may become useful. If you want a broader overview of the legal framework behind these cases, it may also help to read this explanation of how unauthorized payment disputes and reimbursement rights often work.
<aside> 💡 Scroll to the bottom for every post in this series.
</aside>
In general terms, an unauthorized electronic fund transfer is a transfer from a consumer’s account initiated by someone else, without actual authority, and from which the consumer received no benefit. That definition comes from the federal Electronic Fund Transfer Act and Regulation E, the main rules that govern many debit card and electronic payment disputes (CFPB Regulation E overview; Federal Reserve EFTA text).
That can include familiar situations such as:
The Consumer Financial Protection Bureau has explained that Regulation E can apply to debit card transactions and to certain peer-to-peer or wallet-related transfers that debit a consumer account. The CFPB has also said that when a third party fraudulently induces a consumer to share account access information, transfers made with that fraudulently obtained information can still qualify as unauthorized EFTs (CFPB electronic fund transfer FAQs).
That point surprises a lot of people. Many consumers assume that if they were tricked into sharing information, the bank or app can automatically label the transaction “authorized.” In many cases, the legal analysis is more nuanced than that.
Not always, but there is a lot of overlap.
Debit card disputes are often governed by the Electronic Fund Transfer Act and Regulation E because the transaction debits a consumer account electronically. The same can be true for some payment app transfers, mobile wallet transactions, and debit card “pass-through” payments routed through a nonbank payment app. The CFPB has stated that both the account-holding bank and certain covered nonbank payment providers can have error-resolution obligations in these situations (CFPB FAQs on debit card and P2P coverage).
That said, payment app cases often get messier because there may be more than one entity involved: