Key takeaways
- Tell your bank as soon as you spot an unauthorized withdrawal. Reporting a lost or stolen card or PIN within two business days caps losses at $50 or the amount taken, whichever is less.
- After a statement shows an unauthorized withdrawal, you have 60 days from the date the bank sent it to report; waiting longer can make you liable for later transactions.
- Banks generally have ten business days to investigate a reported error, and must correct a confirmed error within one business day of making that determination.
- Transfers you were tricked into approving are usually treated as authorized, so they often fall outside these protections; tell your bank exactly what happened anyway.
- Automatic payments you once allowed can be stopped by revoking authorization with both the company and your bank, in writing.
Checking your account and finding a withdrawal you never made is unsettling. Federal rules place most of the loss on your bank rather than on you, as long as you report quickly. The deadlines are short, though, so the order of steps matters.
First Steps: Confirm What Happened and Protect the Account
Start by working out what kind of transaction you are looking at. An unauthorized transaction is a charge or withdrawal you did not make and did not allow. Not every surprise debit qualifies. If you recognize the company but thought you had canceled, that is a different problem with a different fix.
If a company you once signed up with keeps taking money, you have the right to revoke that permission even if you allowed the payments before. Call the company and say you are withdrawing your authorization for automatic payments, then follow up in writing by letter or email. Do the same with your bank or credit union. Once both have been told, any further payments from that company are errors, and you can contact your bank for a refund. Your bank might also suggest a stop payment order, an instruction that tells the bank not to pay a specified company from your account. Keep dated records of every request you make.
If the withdrawal is genuinely unauthorized, ask the bank to cancel your card and issue a new one, and change your online banking password. Then move on to reporting it.
Tell Your Bank Right Away (and Why Timing Matters)
Call as soon as you spot the withdrawal, even if you are not yet sure it is fraud. An oral report counts. The bank may ask you to confirm in writing, but it must start investigating promptly after your call, so do not wait for a form.
Two deadlines do most of the work. If your debit card or your PIN, the code you enter at cash machines and checkouts, was lost or stolen, notifying the bank within two business days of discovering the loss keeps your liability at its lowest. Separately, once a statement arrives showing an unauthorized withdrawal, you have 60 days from the date the bank sent it to report the problem. Miss that window and you could owe the full amount of any transactions that occur after it and before you speak up, provided the bank can show that an earlier report would have stopped them.
Write down the date and time of each call and the name of anyone you speak with.
The Federal Rules That Protect Debit Card and ACH Transfers
Withdrawals from a bank account fall under the Electronic Fund Transfer Act, a federal law from 1978, carried out through Regulation E, a rule maintained by the Consumer Financial Protection Bureau. The rule covers electronic fund transfers: ATM withdrawals, debit card purchases, some online bill payments, and payments set up to leave your account automatically, including ACH transfers. ACH stands for automated clearinghouse, the network banks use to move money between accounts.
At the center of the rule is a set of liability limits, meaning the most you can be made to pay for unauthorized transfers. How much depends on how fast you report.
| When you notify the bank | Most you can owe |
|---|---|
| Within two business days of learning your card or access code was lost or stolen | $50 or the amount of the unauthorized transfers, whichever is less |
| After two business days, up to the statement deadline | Up to $500 in unauthorized transactions |
| More than 60 days after the statement showing the withdrawals | The full amount of any transactions after that 60-day period and before you reported |
Two details are easy to miss. Your liability is set by how promptly you report the loss or theft of your card, code or other access device, and by nothing else. Your bank’s agreement also cannot hold you to more than these limits, and behavior that looks careless, such as writing your PIN on the card or on a piece of paper kept with it, cannot be used to charge you more than the rule allows.
How the Dispute Process Works and What the Bank Must Do
Your notice needs to give the bank enough to work with: your name and account number, and why you believe an error exists, including the type, date and amount of the transaction if you know them.
Once the bank receives your notice, it generally has ten business days to investigate. If it determines an error occurred, it must correct the error within one business day of that determination and then has three business days to report its findings to you. Some banks credit the disputed amount to your account while the investigation continues, a practice known as provisional credit. If the bank later decides the transaction was legitimate, it can take the credit back, so leave a cushion in the account until the case closes.
Reporting late is not always fatal. Even when a notice arrives more than 60 days after the statement, the unlimited exposure applies only to transactions that happened after that 60-day period. The standard limits still cover transactions that came before it.
What If You Gave Out Your Details to a Scammer?
This is where the rules draw a line that surprises many people. If a thief obtained your card details or account access and moved money without your approval, the transfer is unauthorized, even if the physical card never left your wallet. The protections described above apply.
If a scammer persuaded you to approve the payment yourself, through a fake bank alert, a phony job or a convincing phone call, the law treats the transfer as authorized. Payments you were tricked into approving generally fall outside the unauthorized-transaction protections, which means the bank may not be required to refund you under the rules above. Tell the bank exactly what happened anyway and ask what options exist. Some banks review these cases under their own policies, and other rules can apply depending on how the money moved.
Money tip: Keep your PIN out of your wallet and off the card itself. If the card or the wallet is lost or stolen, you do not want the code traveling with it.
Reporting the Theft and Preventing a Repeat
Reporting beyond your bank puts the theft on record with agencies that track fraud and can help protect others from the same scheme. Our guide to reporting a scam in the United States walks through where to file and what details to have ready.
If you handed over your account number or other personal information, it makes sense to keep an eye on your credit reports afterward. A credit report is the file that lenders pull when deciding whether to lend to you, so it can show early signs that someone is trying to borrow in your name. Our article on checking your credit report and disputing errors shows how to read each report and get mistakes corrected.
A few habits reduce the chance of a repeat:
- Review statements as they arrive. The 60-day clock runs from the date the bank sends each statement, not from when you finally read it.
- Turn on account alerts so you learn about unexpected withdrawals in hours rather than weeks.
- Be careful with automatic debits. Companies must tell you at least 10 days before a payment that differs from the authorized amount or range. Canceling the payments does not cancel the contract; cancel the service with the company separately.
- Keep a cash buffer. A reserve makes it easier to absorb a drained account while a dispute is pending.
- How Big Should Your Emergency Fund Be?: how large a buffer to aim for, which helps if your account is drained during a dispute.
- How to Automate Your Savings (and Why It Works): a steady way to rebuild a drained account without relying on willpower.
Common questions
Q: How long does my bank have to investigate a disputed withdrawal?
A: Generally ten business days from your notice. If the bank determines an error occurred, it must correct it within one business day and then has three business days to report its findings to you.
Q: What happens if I report after 60 days?
A: You could owe the full amount of transactions that occurred after the 60-day period and before you reported, if the bank can show an earlier notice would have prevented them. The standard liability limits still apply to transactions before that point.
Q: Does it matter that I wrote my PIN on my card?
A: No. Carelessness cannot be used to impose liability greater than the limits in Regulation E allow. Your liability depends on how quickly you report the loss or theft, not on how you stored your PIN.
Q: Can I stop a company from taking automatic payments I once agreed to?
A: Yes. Call and write both the company and your bank to revoke authorization. After that, further payments from that company are errors you can dispute with your bank for a refund.
This article is for general information and education only and isn’t personal financial, tax or legal advice. Rates, fees and rules change, so check current details with the provider or an official source before making decisions.