Last year, the Federal Trade Commission logged more than 2.6 million reports of fraud, and a large share of those involved unauthorized bank transactions. I have helped friends walk through this exact process, and the panic is real when money disappears from your account overnight.
This guide explains how to dispute an unauthorized bank transaction under Regulation E timelines. You will learn the deadlines, the paperwork, and the steps the bank has to follow. I will also flag the common mistakes I have seen people make, so you can avoid them.
If you just discovered a charge you did not authorize, start with the quick checklist below. Then read the full breakdown that follows.
Table of Contents
Quick Action Checklist for Disputing an Unauthorized Bank Transaction
Use this checklist the moment you spot unauthorized activity on your statement.
Flag the statement date the charge first appeared on your account.
Call your bank within two business days to lock the card and limit liability.
Confirm in writing within 60 days of the statement date (email, secure message, or signed letter).
Save every reference number, agent name, and a copy of the dispute form.
Ask the bank about provisional credit if the investigation will take longer than 10 business days.
Follow up in writing if the bank misses any timeline.
What Is Regulation E and Why It Protects You?
Regulation E is the federal rule (12 CFR Part 1005) that implements the Electronic Fund Transfer Act of 1978. It protects consumers when money moves electronically, including debit card purchases, ATM withdrawals, ACH transfers, and many app-based payments.
The rule gives you three core rights. First, you can dispute errors and unauthorized transfers. Second, the bank has to investigate within strict timeframes. Third, your personal liability is capped as long as you report promptly.
Regulation E was designed to push the burden of proof onto the bank rather than the consumer. Before the rule existed, customers often had to fight lengthy legal battles to recover losses. Today, the bank must produce the records and demonstrate that the transaction was authorized.
Regulation E does not cover every type of transaction. Wire transfers, credit card charges, and most checks fall under different rules. Knowing whether your situation falls under Reg E is the first step before you file a dispute.
What Counts as an Unauthorized EFT Under Regulation E?
An unauthorized electronic fund transfer is one that you did not authorize and that did not benefit you. It includes charges made with a lost or stolen card, transfers initiated by someone using your account information, and direct debits you never agreed to.
Common examples I have seen include a $400 debit at an out-of-state electronics store, unexplained ACH pulls from a payday lender, and Zelle transfers sent by a thief who had your login. Courts have consistently treated these as unauthorized under Reg E.
Transactions are generally not considered unauthorized when you gave someone your card or login, even if you regret the purchase. The rule also draws a line between unauthorized activity and ordinary merchant disputes about goods or services. For example, if you bought a defective product with your debit card, that is a merchant dispute, not a Reg E claim.
Joint account holders can also create confusion. If your spouse or co-account holder made a transfer you did not approve, the bank may still classify it as authorized. Document any disagreement and ask the bank about its policy in this case.
The 60-Day Notice Requirement Explained
You must notify your bank within 60 days of the periodic statement that first showed the error. The 60-day clock starts on the statement date, not the transaction date, and it includes weekends and holidays.
For example, if your January statement dated January 15 lists a $250 charge you did not authorize, the deadline to notify the bank is March 16. If you wait until April, the bank has no Reg E obligation to investigate, even if it later finds clear fraud.
You can give notice in person, by phone, or in writing. I always recommend following up a phone call with a written notice through your bank’s secure messaging portal. That creates a paper trail you can use if the dispute is later denied.
If the bank sends a follow-up statement that should have triggered an earlier notice, the 60-day clock can reset. Keep an eye on every statement, especially after the first suspicious charge, because thieves often test a card with small charges before a larger attack.
Step-by-Step: How to Dispute an Unauthorized Bank Transaction Under Regulation E
Follow these steps in order. Skipping a step can weaken your case or push you past a deadline.
Review your statement carefully. Identify the date, amount, merchant name, and any other unknown charges. Look for patterns such as multiple small test charges that often precede a larger fraud event.
Lock your card immediately. Call the number on the back of your card or use the bank’s app to freeze the account. This stops additional unauthorized charges and is required to qualify for the lowest liability tier.
Change your online banking credentials. Update your password, enable two-factor authentication, and remove any saved payment methods. This prevents the same thief from returning.
File the dispute within 60 days. Submit the dispute through the bank’s official channel within 60 days of the statement date. Most banks have a digital dispute form. Ask for a confirmation number.
Ask for a written confirmation. Under Reg E, the bank must confirm receipt of your error notice within 30 days. If you do not receive it, send a follow-up by certified mail.
Ask about provisional credit. If the bank cannot complete the investigation within 10 business days, request provisional credit in writing. Banks must extend the credit when the claim involves a new account, a point-of-sale transaction, or an unauthorized transfer initiated outside your state.
Document everything. Keep copies of every email, screenshot, and letter. Note the date, time, and name of every bank representative you speak with.
Follow the final decision in writing. If the bank denies your claim, you have the right to ask for the documents and investigation notes. Reg E lets you reassert the error later if new evidence appears.
Understanding the Regulation E Timelines: 10-Day and 45-Day Investigation
The bank’s investigation must finish within 10 business days of receiving your notice. That is the core rule that makes Reg E so effective, and it is shorter than most people expect.
The bank can extend the investigation to 45 calendar days, but only in specific cases. Extensions are allowed for new accounts (less than 30 days old), point-of-sale transactions using a card or code, and transfers initiated outside any U.S. state.
Outside those cases, the bank cannot simply buy more time. If the bank extends without a valid reason, your dispute is eligible for provisional credit and you can file a complaint with the Consumer Financial Protection Bureau.
If the bank cannot finish within these timelines, it must issue provisional credit to your account. The credit can be reversed later only if the investigation later shows the transaction was, in fact, authorized.
Here is a simple way to track the timeline:
Day 0: Bank receives your written notice.
Day 1 to 10: Bank must complete the investigation under standard rules.
Day 11 to 30: Bank must provide a written confirmation of your error notice.
Day 11 to 45: Extended investigation window applies only in limited cases.
Day 3 after the investigation: Bank must report its findings to you.
Day 1 after the investigation: Bank must correct any confirmed error.
Mark each of these dates on a calendar the moment you file the dispute. If the bank misses any of them, that is a clear Reg E violation you can reference in your escalation.
How Provisional Credit Works During a Reg E Investigation
Provisional credit is a temporary refund the bank issues while it investigates an error. It restores your account balance so you can pay bills and avoid overdrafts while the bank gathers records.
Reg E requires the bank to issue provisional credit within 10 business days if the investigation will take longer than 10 business days. The bank cannot delay this simply because it wants more time. The credit must be automatic, not optional.
Some consumers I have worked with were issued provisional credit and then had it reversed weeks later. In one case, the bank restored the credit after the customer reasserted the error with a police report. The provisional credit rule is a powerful tool, but it requires you to keep records.
If the bank later determines the transaction was authorized, it can reverse the provisional credit and explain its decision in writing. If you disagree with the finding, you can reassert the error and ask the bank to share the documents it relied on.
Sample Written Notice You Can Send to Your Bank
A clear written notice speeds up the investigation and protects you if the case is later denied. Use this template as a starting point and customize it for your situation.
Include your name, account number (last four digits only), date of the statement, the disputed amount, and the merchant name. State clearly that you did not authorize the transaction and request a written investigation under Regulation E, 12 CFR Part 1005. Ask for provisional credit if the bank cannot finish within 10 business days.
Send the notice through the bank’s secure messaging portal, and keep a copy. If you send a paper letter, send it by certified mail with return receipt requested. That gives you a legal record of when the bank received the notice.
Consumer Liability Limits Under Regulation E
Your personal liability for unauthorized transfers is capped based on how quickly you notify the bank. The tiers are designed to push you to act fast.
You notify before any unauthorized charge occurs: $0 liability.
You notify within two business days of learning about the loss or theft: $50 maximum liability.
You notify between three business days and 60 days after the statement: Up to $500 liability.
You notify more than 60 days after the statement: Unlimited liability for additional unauthorized transfers.
The key takeaway is that a 24-hour delay can cost you hundreds of dollars. A two-month delay can cost you everything. This is why I always tell people to lock the card first, then document the dispute.
These caps apply to consumer accounts, not to business accounts. If you operate a small business account, the bank may apply different rules and higher liability limits. Always confirm the account type before relying on Reg E protections.
What Happens If You Miss the 60-Day Deadline?
If you miss the 60-day notice requirement, the bank has no Reg E obligation to investigate or refund the charge. You can still ask, and the bank may voluntarily help, but it is no longer required to do so.
You may still have other options. Identity theft claims can sometimes be escalated under the Fair Credit Reporting Act. Civil claims can be filed in small claims court. And the bank may make an exception if the unauthorized charge was the result of a security breach at the bank itself.
Do not assume the dispute is dead because the deadline passed. Reach out to the bank’s fraud department, escalate to a supervisor, and ask whether any goodwill exception applies. Some banks will still issue a refund to keep a long-term customer.
Your Rights When a Bank Denies Your Reg E Claim
If the bank denies your claim, you have several rights. The bank must explain the reason in writing. It must also share the documents it used in the investigation, including merchant records and transaction logs.
You can reassert the error if you find new evidence later. Reg E specifically allows you to present the same claim again if you obtain additional information that was not available during the first investigation. New evidence often includes merchant responses, IP address logs, or even a police report that did not exist earlier.
You can also escalate the dispute. File a complaint with the Consumer Financial Protection Bureau, contact your state attorney general, or send a written demand letter through an attorney. Banks take these escalations seriously because they trigger regulatory reporting requirements.
A CFPB complaint often produces a direct response from the bank within 15 days. Banks want to close complaints cleanly to avoid public flags on their consumer compliance record. State attorney general offices can also help when a bank appears to be ignoring Reg E deadlines.
Common Regulation E Mistakes to Avoid
After reading forum stories and walking through real cases, I see five mistakes repeatedly. Avoid them and your dispute has a much higher chance of success.
Waiting for the next statement. The 60-day clock starts on the statement date, not the date you notice the charge.
Only notifying by phone. Phone notices start the process, but written notice is your strongest protection if the bank denies the claim.
Ignoring the bank’s requests. If the bank asks for an affidavit or a police report, give it promptly. Delay can be used against you.
Assuming the bank will issue provisional credit automatically. Ask for it in writing if the investigation extends beyond 10 business days.
Letting the merchant handle it. Reg E disputes go to the bank, not the merchant. Going to the merchant first can waste valuable time.
Does Regulation E Cover P2P Payments Like Zelle and Venmo
Regulation E can apply to P2P payments, but only in specific cases. If a thief accessed your account without your permission and sent a Zelle or Venmo payment, that is an unauthorized EFT and Reg E should apply.
If you authorized the payment, even by mistake, Reg E generally does not apply. Many banks also place additional fraud protections on P2P apps, but those are voluntary, not Reg E obligations. Always report P2P fraud to your bank within 24 hours to lock in the strongest protection.
For Zelle, the bank that holds the recipient’s account is generally the only one that can reverse the payment. If the money has already been withdrawn, recovery is harder. Treat P2P fraud like a stolen debit card and move fast.
Frequently Asked Questions About Regulation E Disputes
What is the timeframe for a Regulation E dispute?
You must notify your bank within 60 days of the periodic statement that first showed the unauthorized transaction. The bank must investigate within 10 business days, extendable to 45 calendar days in limited cases. Provisional credit is required if the investigation goes beyond 10 business days.
What if the bank won’t refund an unauthorized transaction?
Ask the bank to provide its investigation findings in writing. You can reassert the error with new evidence, file a complaint with the Consumer Financial Protection Bureau, and contact your state attorney general. Reg E requires the bank to explain a denial and share the documents behind the decision.
What is considered an unauthorized transaction under Reg E?
An unauthorized EFT is a transfer you did not permit and did not benefit from. It includes charges made with a lost or stolen card, transfers initiated by someone using your account credentials, and direct debits you never approved. Transactions you authorized but later regret are generally not unauthorized.
What are some common mistakes when using Reg E?
Common mistakes include missing the 60-day deadline, relying only on phone notice, ignoring bank requests for documentation, assuming provisional credit is automatic, and sending the dispute to the merchant instead of the bank. Avoiding these mistakes significantly improves your outcome.
How long does a bank have to investigate under Regulation E?
The bank must complete its investigation within 10 business days under standard rules. The window can extend to 45 calendar days only for new accounts, point-of-sale card transactions, and transfers initiated outside any U.S. state. If the investigation passes 10 business days, provisional credit is required.
Can a bank deny a Reg E claim?
Yes. The bank can deny the claim if it finds the transaction was authorized, if you missed the 60-day notice window, or if the documentation does not support an error. The bank must explain the denial in writing and share the documents behind its decision. You can reassert the error with new evidence.
Does Regulation E apply to credit card disputes?
No. Credit card disputes are governed by the Fair Credit Billing Act, which has its own 60-day notice window and different investigation rules. Debit card transactions on a checking account generally fall under Reg E instead.
Can the bank require a police report for a Reg E dispute?
The bank can request an affidavit, a written statement, or other supporting documentation, but it cannot make Reg E investigations contingent on a police report. Police reports can strengthen your case, especially in identity theft situations, but they are not a strict requirement.
Final Thoughts on Disputing an Unauthorized Bank Transaction Under Regulation E
Disputing an unauthorized bank transaction under Regulation E is built around a simple promise. Notify within 60 days, and the bank has to investigate within 10 business days. If it takes longer, you get provisional credit automatically.
Keep your copy of the statement, send written notice, and follow up if the bank misses a deadline. If the bank denies your claim, you have clear next steps to escalate the dispute. Acting quickly and staying organized is the difference between a $0 loss and a $500 liability hit.
You have strong federal protections on your side. Use them, document everything, and push the bank to follow its own timelines. The rule was written for exactly the kind of situation you are facing right now.