If Money Leaves Your Account Without You, Federal Rules Cap What You Owe at $50 — If You Report It Within Two Business Days

When an electronic transfer leaves a consumer account without authorisation — a debit card charge, an ACH debit, an online transfer — what the consumer can be made to bear is capped by federal regulation, and the cap depends almost entirely on timing. Regulation E, at 12 CFR Part 1005, sets the tiers. Section 1005.6 governs how much the consumer can owe. Section 1005.11 governs how fast the institution has to act.

The liability tiers

• Notice within two business days of learning of the loss or theft: liability shall not exceed the lesser of $50 or the amount of unauthorised transfers occurring before notice.
• Notice after two business days: liability shall not exceed the lesser of $500 or the sum of up to $50 for transfers in the first two-day window, plus subsequent transfers the institution can establish would not have occurred had notice been timely.
• An unauthorised transfer that appears on a periodic statement and is not reported within 60 days of the institution sending that statement: the consumer remains liable for transfers occurring after those 60 days close and before notice is given, where the institution establishes they would not have occurred had the report been timely.
• Where a delay is caused by extenuating circumstances, the regulation requires the institution to extend these periods to a reasonable time.

The structure rewards speed rather than certainty. The two-day clock runs from when the consumer learns of the loss or theft, not from the transfer itself, which is why checking statements and alerts promptly is what preserves the lowest tier.

The institution's clock

Section 1005.11 requires the consumer to report a suspected error within 60 days of the institution sending the periodic statement or providing passbook documentation showing it. The notice must identify the account, say why an error is believed to exist, and where possible give the type, date and amount of the transfer.

• The institution must investigate promptly and determine whether an error occurred within 10 business days of receiving notice.
• Results must be reported to the consumer within three business days of completing the investigation.
• If the institution cannot finish within 10 business days, it may take up to 45 days, but only if it provisionally credits the disputed amount within those 10 business days, less up to $50 for an unauthorised transfer, tells the consumer the amount credited, and gives full use of the funds.
• A confirmed error must be corrected within one business day.

The longer windows

• New accounts: for errors involving transfers within 30 days of the first deposit, the investigation deadline is 20 business days rather than 10, and the extension runs to 90 days rather than 45.
• Point-of-sale debit card transactions: the extended investigation period is 90 days.
• Transfers initiated outside the United States: the extended investigation period is 90 days.

What counts as an error

The regulation's definition of error covers an unauthorised transfer, an incorrect transfer to or from the account, an omission of a transfer from a statement, a computational or bookkeeping mistake by the institution, an incorrect amount of cash dispensed by a terminal, a transfer not properly identified, and a request for documentation or clarification about a transfer. Routine balance inquiries, requests for records for tax purposes and duplicate documentation requests are specifically excluded.

This article explains published federal regulation and is for informational purposes only. It is not legal or financial advice. The regulation's text and official interpretations govern; anyone disputing a transfer should consult the regulation, their institution's error resolution notice, or a qualified professional.