The federal rules that limit a consumer's loss from an unauthorized debit card, ATM, ACH or payment-app transfer, require the bank to investigate an error, and decide who bears a loss the consumer was tricked into sending themselves.
Credit card disputes and debit card disputes run under different laws. A debit card, an ATM withdrawal, an automatic bill payment from a checking account, a payroll card, and a transfer made through a payment app linked to a consumer's account are all electronic fund transfers, governed by the Electronic Fund Transfer Act and its Regulation E. The Act limits how much a consumer can lose from an unauthorized transfer, in tiers that depend on how quickly the consumer reports it after learning of the loss or receiving the statement showing it - report promptly and the exposure is small; wait beyond the periods the rule states and it can grow to the whole amount taken afterwards.
The Act also imposes an error-resolution procedure. When a consumer notifies the bank of an error - an unauthorized transfer, a wrong amount, a transfer that never arrived, a missing statement item - the bank must investigate within the period the rule sets, and if it needs longer it must provisionally credit the consumer's account while it does. It must report the result in writing and, if it decides no error occurred, explain why and provide the documents it relied on. A bank that fails the procedure is liable for the consumer's losses and, in some circumstances, treble damages.
The unsettled question is scams. A transfer is unauthorized when it was initiated by someone without the consumer's authority; a transfer the consumer was deceived into initiating themselves - sending money to a fraudster posing as the bank, a relative or a seller - has generally been treated as authorized and outside the protection, and that reading is being contested by regulators, in litigation and in proposed legislation. Business accounts are not covered by the Act at all, and a transfer made by someone the consumer gave their card or credentials to is not unauthorized until the consumer has told the bank that person is no longer permitted.
A consumer who finds an unauthorized transfer should notify the bank immediately, in writing as well as by phone, because every protection in the Act is measured from when the bank was told. If the bank refuses to investigate, misses its deadlines, or denies a claim without the written explanation the rule requires, a lawyer or the Consumer Financial Protection Bureau's complaint process is the next step; and a consumer who was tricked into sending money should ask a lawyer whether the facts can be framed as unauthorized before accepting the bank's answer.
Choose your state. Each link opens the directory page for the city in that state with the most currently published law firms in this practice area; a +n beside the city is how many other cities in the state also have one. The list is generated when this page loads, so a state whose listings have lapsed drops out rather than becoming a dead link.