Money Was Taken From My Bank Account Without Permission: What Are My Rights?

Seeing money disappear from your bank account can be frightening, especially when you have no idea how the transaction happened.

Maybe someone used your debit card. Maybe there was an ATM withdrawal you never made. Maybe money was transferred through your online banking account. Or perhaps an ACH withdrawal appeared from a company or person you do not recognize. Consumers often describe these situations simply: “Money was taken out of my account, and I did not authorize it.”

Federal law may provide protections for certain unauthorized electronic transactions through the Electronic Fund Transfer Act (EFTA) and its implementing regulation, Regulation E. The exact rights available depend on how the transaction occurred, when you discovered it, when you notified the bank, and other facts surrounding the transfer.

The EFTA protects accounts established primarily for personal, family, or household purposes, such as checking and savings accounts. Business accounts are generally not covered.

Someone Transferred Money Out of My Account Without My Permission. What Should I Do?

Start by reporting the transaction to your bank or credit union as soon as possible. Tell the financial institution clearly that you did not make the transaction, you did not authorize someone else to make it, you believe the transaction is an error or unauthorized transfer, and you want the institution to investigate it.

Under Regulation E, an unauthorized electronic fund transfer generally means an electronic transfer from a consumer’s account that was initiated by someone other than the consumer, without actual authority, and from which the consumer received no benefit. That definition can include circumstances in which someone obtained access to an account through fraud.

The important point: you do not necessarily have to know how the person obtained your information before reporting the transaction. If you know you did not authorize the transfer, tell the bank that directly.

What If I Was Tricked Into Sending the Money Myself?

This is an important distinction. If a scammer convinced you to send the money yourself (for example, someone impersonating your bank, a government agency, or a family member talked you into making a Zelle or other payment), Regulation E generally treats that transfer as authorized, because you initiated it. The EFTA’s reimbursement protections may not apply the same way they do when someone else gets into your account and moves the money. Wire transfers are also generally outside the EFTA. You should still report a scam payment to your bank immediately, since the bank’s own policies or other laws may help, and the facts of how the payment happened matter.

What If Someone Stole Money From My Bank Account Through Identity Theft?

Identity theft does not always look like someone opening a credit card in your name. Sometimes the first sign is money disappearing from an existing bank account.

A thief might obtain online banking credentials, debit-card information, a PIN, account information, or other credentials that allow access to funds, and the consumer may have no idea how the information was compromised. That does not mean you should wait until the entire identity-theft scheme is figured out before contacting the bank. If unauthorized electronic transactions resulted from someone fraudulently obtaining access to the account, the EFTA and Regulation E may be relevant. (For how identity theft can also damage your credit, see how the FCRA protects identity theft victims.)

Unauthorized withdrawals can also cause a chain reaction: returned payments, overdraft fees, and missed bills that end up reported to the credit bureaus or sent to collections. If that happens, the Fair Credit Reporting Act gives you the right to dispute inaccurate information on your credit report.

Someone Got Into My Online Banking Account and Took My Money. Does the EFTA Apply?

Potentially. The EFTA is broader than physical debit-card theft. Electronic fund transfers can include transactions involving ATMs, debit cards, certain online payments and electronic transfers, and some automatic deductions from a consumer’s account. The legal analysis depends on the specific method used to move the money.

That is why it is important to preserve information showing the date of each transfer, the amount, where the money went, how the bank describes the transaction, login or security alerts you received, communications with the bank, and when you first discovered the activity. Do not assume that because the transaction occurred online, you automatically authorized it.

My Debit Card Was Used Without My Permission. Is the Bank Responsible?

Unauthorized debit-card transactions are one of the situations Regulation E specifically addresses. However, consumer liability can depend heavily on how quickly the loss or unauthorized transaction is reported.

Under Regulation E, if your debit card or other access device is lost or stolen and you notify the bank within two business days after learning of it, your liability is generally limited to $50 or the amount of the unauthorized transfers, whichever is less. If you wait longer, your liability can rise to as much as $500. And if unauthorized transfers appear on your statement and you do not report them within 60 days after the bank sends that statement, you can be responsible for later unauthorized transfers that would not have happened if you had reported in time. Many banks and card networks also offer “zero liability” policies that can go further than the law requires.

Waiting can become expensive. If you see a debit-card transaction you did not make, report it promptly rather than assuming the bank will automatically detect and correct it. (Unauthorized credit card charges are handled under a different federal law, the Fair Credit Billing Act, rather than the EFTA. Learn more about unauthorized credit card transactions.)

Someone Made Unauthorized ATM Withdrawals From My Account. What Can I Do?

ATM withdrawals from a consumer account are electronic fund transfers covered by Regulation E. If you did not make the withdrawal and did not authorize someone else to make it, notify your bank immediately.

Keep copies of the statement showing the ATM withdrawal, the ATM location if available, the date and time, fraud alerts or text messages, police or identity-theft reports if applicable, communications with the bank, and the bank’s written decision regarding your dispute. Regulation E guidance also recognizes that an ATM transfer induced by force can qualify as an unauthorized electronic fund transfer.

What About an Unauthorized ACH Withdrawal From My Bank Account?

Consumers may discover recurring withdrawals or one-time electronic debits that they do not recognize. Sometimes the transaction is clearly fraudulent. Other times there may be a dispute about whether the consumer actually authorized the withdrawal, and the distinction matters.

A transfer initiated by someone who obtained access through fraud can potentially qualify as unauthorized. But Regulation E treats some situations differently when a consumer voluntarily gave another person authority to access the account, so the facts surrounding the alleged authorization can be extremely important.

If an unfamiliar ACH transaction appears, ask the bank for information identifying the originator, the date authorization allegedly occurred, the transaction identification, the amount, whether the transaction is recurring, and any documents or records the bank relied upon.

I Do Not Know How They Got Into My Account. Can I Still Dispute the Transactions?

Yes. You can report an unauthorized transaction even when you do not know exactly how the fraud occurred. Consumers frequently know the result before they know the mechanism: you may know “I did not transfer this money” without knowing “someone obtained my credentials through a phishing email three weeks ago.” Do not let uncertainty about how the fraud happened stop you from reporting what you know.

Regulation E generally requires enough information for the financial institution to identify the consumer and account and understand why the consumer believes an error occurred, including the type, date, and amount when possible.

What Should I Do After Discovering Unauthorized Bank Transactions?

1. Contact the bank and report each transaction you believe was unauthorized.
2. Change compromised credentials. Depending on what happened, that could include your online banking password, PIN, email password, or other security information.
3. Create a record. Save screenshots, statements, confirmation numbers, emails, text alerts, letters, and notes from telephone conversations.
4. Watch your statements and deadlines. Regulation E generally requires a consumer to notify the financial institution of an error no later than 60 days after the bank sends the periodic statement on which the error first appears in order to trigger the regulation’s standard error-resolution protections. Different rules can apply when an access device such as a debit card is lost or stolen.
5. Read the bank’s response carefully.

The fact that a bank says a transaction was “authorized” does not necessarily end the inquiry. The next question becomes: how did the bank investigate the claim, and what evidence did it rely upon? That leads to a separate set of rights under Regulation E, explained in what to do if your bank denied your fraud claim.

The Bottom Line

When money disappears from a bank account, consumers should not be expected to know phrases like “unauthorized EFT,” “EFTA,” or “Regulation E” before asking for help. Most people experience the problem much more simply: money left my account, and I did not authorize it.

Federal law establishes procedures for investigating certain electronic-transfer errors and limits consumer liability in qualifying circumstances. The sooner the transaction is identified, documented, and reported, the better positioned the consumer may be to protect those rights.

How Rahman Legal Can Help

Rahman Legal represents New York and Massachusetts consumers in matters involving unauthorized bank transfers, identity theft, and credit reporting. If money was taken from your account and your bank has not resolved it, we can review the transactions, your communications with the bank, and your timeline to help you understand your options. Contact Rahman Legal to request a consultation. No outcome is guaranteed; every matter is evaluated individually.

Frequently Asked Questions

Does the EFTA cover money taken from my bank account without permission?

It can. The Electronic Fund Transfer Act and Regulation E cover many unauthorized electronic transfers from personal accounts, including debit-card, ATM, ACH, and certain online transfers made by someone without your permission. Whether it applies depends on how the money was moved and when you reported it.

How fast do I need to report an unauthorized transaction to my bank?

As soon as possible. If a debit card or other access device is lost or stolen, reporting within two business days generally limits your liability to $50. Unauthorized transfers shown on a statement should be reported within 60 days after the statement is sent.

What if I was scammed into sending the money myself?

Regulation E generally treats a transfer you initiated yourself as authorized, even if a scammer tricked you, so the EFTA’s reimbursement protections may not apply the same way. Report it to your bank right away anyway; the facts and the bank’s own policies still matter.

Do I need to know how the thief got into my account before I report it?

No. You can report an unauthorized transaction even if you do not know how your information was compromised. Tell the bank you did not make or authorize the transfer and ask it to investigate.

This article provides general information and is not legal advice. Whether the EFTA or Regulation E applies depends on the specific facts of the transaction.

Reviewed by Hashim Rahman, Esq.

Primary References

• CFPB Regulation E § 1005.2 – Definitions
• CFPB Official Interpretation of § 1005.2
• CFPB Regulation E § 1005.6 – Liability of Consumer
• CFPB Regulation E § 1005.11 – Error Resolution
• CFPB Electronic Fund Transfer FAQs