Your Bank Has 10 Days to Refund Unauthorized Charges — Here's the Law Most People Don't Know

Last year, 62 million Americans experienced unauthorized charges on their debit or credit cards. Most waited weeks for their bank to sort it out — not knowing that federal law requires a resolution in 10 business days. The law is called Regulation E, and it's one of the most powerful consumer protections that almost nobody invokes.

Table of Contents

• The Scale of the Problem
• What Is Regulation E?
• The 10-Day Rule Explained
• Your Liability Depends on When You Report
• What Your Bank Cannot Do
• How to Dispute Unauthorized Charges Step by Step
• What If Your Bank Ignores the Law?
• Why This Matters More in 2026
• Frequently Asked Questions

The Scale of the Problem

Identity fraud losses hit $27.2 billion in 2024 — a 19% jump from $22.9 billion the year before, according to Javelin Strategy & Research's 2025 Identity Fraud Study. Account takeover fraud alone surged 23% to $15.6 billion.

Debit cards account for 39% of all financial institution fraud losses, according to the Federal Reserve. That matters because debit card fraud hits differently than credit card fraud — the money comes directly out of your checking account. You're not disputing a line item on a bill. You're missing rent money.

Here's the part that should frustrate you: Security.org's 2025 fraud survey found that 93% of people who reported fraud got their money back. The system works — when people actually use it.

What Is Regulation E?

Regulation E is a federal regulation (12 CFR Part 1005) enforced by the Consumer Financial Protection Bureau (CFPB). It implements the Electronic Fund Transfer Act (EFTA) of 1978 and governs electronic transactions including:

• Debit card transactions (point of sale and online)
• ATM withdrawals
• Direct deposits and automatic bill payments
• Peer-to-peer transfers (Venmo, Zelle, Cash App — with important exceptions)
• ACH transfers

The regulation sets strict rules for how banks must handle disputes over unauthorized electronic fund transfers. The critical part that most people miss: it puts specific deadlines on your bank, with real consequences if they don't comply.

Important distinction: Regulation E covers debit cards and electronic fund transfers. Credit card disputes fall under Regulation Z (the Fair Credit Billing Act), which has similar but separate protections. If fraud happened on your credit card, the liability rules differ. This post focuses on debit cards, bank accounts, and electronic transfers — the ones where money leaves your account immediately.

The 10-Day Rule Explained

Here's the core of Regulation E's investigation requirements under §1005.11:

Step 1: You notify your bank of an unauthorized charge. This starts the clock.

Step 2: Your bank has 10 business days to investigate and resolve the claim.

Step 3: If the bank cannot complete its investigation within 10 business days, it must provisionally credit your account for the disputed amount (minus up to $50) and continue investigating for up to 45 calendar days.

Step 4: The bank must notify you of the results in writing within 3 business days of completing the investigation.

That provisional credit is the part people don't know about. You don't have to wait 45 days with an empty bank account. If your bank is still investigating at the 10-day mark, you get the money back in your account while they figure it out.

Extended Timelines

There are two situations where the bank gets more time:

• New accounts (less than 30 days old): The bank has 20 business days instead of 10 before provisional credit is required, and up to 90 calendar days total investigation time.
• Foreign transactions, point-of-sale debit, or new account transfers: Up to 90 calendar days total investigation time (but provisional credit is still required at the 10-day or 20-day mark).

Your Liability Depends on When You Report

Regulation E's liability rules (§1005.6) create a clear incentive to report fraud fast:

Let's put real numbers on this. Say someone makes $500 in unauthorized charges on your debit card:

• Report within 2 days: You're liable for at most $50. The bank must return at least $450.
• Report after 2 days (within 60 days): You're liable for up to $500. You might get nothing back.
• Report after 60 days: You could lose the full $500 — plus any charges made after the 60-day window.

The takeaway: check your bank statements regularly and report anything suspicious immediately. The clock starts ticking when the statement is sent, whether or not you open it.

What Your Bank Cannot Do

This is where Regulation E gets its teeth. Banks have been known to delay, deflect, or deny fraud claims using tactics that are explicitly prohibited under the law.

Under Regulation E, your bank cannot:

1. Require you to contact the merchant first. The bank's obligation to investigate is independent of any merchant dispute process.
2. Require a police report before starting or completing its investigation.
3. Blame your negligence — like writing your PIN on your card — to impose greater liability than Regulation E allows.
4. Impose greater liability by contract than what Regulation E specifies. Your account agreement cannot override federal law.
5. Delay the investigation while waiting for additional information from you. Once you report the fraud, the 10-day clock starts.

If a bank representative tells you any of these things are required, they are either misinformed or hoping you won't push back. You are not legally obligated to do anything other than report the unauthorized charge.

How to Dispute Unauthorized Charges Step by Step

Here's exactly what to do when you spot an unauthorized charge:

1. Document Everything First

Before you call:

• Screenshot the unauthorized transaction(s) from your bank app or statement
• Note the date, amount, and merchant name of each charge
• Write down when you first noticed it

2. Call Your Bank Immediately

• Call the number on the back of your debit card
• Say: "I'm reporting unauthorized electronic fund transfers under Regulation E"
• Name the specific transactions by date and amount
• Ask for a case number and the name of the representative

3. Follow Up in Writing Within 10 Days

Under §1005.11(b)(1), your bank may require written confirmation. Send a letter or secure message that includes:

• Your name and account number
• A description of the unauthorized transactions
• The date you reported by phone
• A statement that you did not authorize these transactions
• A reference to Regulation E, 12 CFR §1005.11

Keep a copy of everything.

4. Track the 10-Day Deadline

Mark the date that is 10 business days from your report on your calendar. If the bank hasn't resolved the claim by that date, call and specifically ask: "Has provisional credit been issued to my account per Regulation E §1005.11(c)(2)?"

5. Escalate If Needed

If provisional credit has not been issued and the investigation isn't resolved:

• Ask to speak with the bank's compliance department (not just customer service)
• Reference the specific regulation: 12 CFR §1005.11(c)(2)
• Mention that you will file a complaint with the CFPB if the issue isn't resolved

What If Your Bank Ignores the Law?

If your bank doesn't comply with Regulation E's deadlines, you have real recourse:

File a CFPB complaint. The Consumer Financial Protection Bureau enforces Regulation E. File a complaint at consumerfinance.gov/complaint or call (855) 411-2372. According to the CFPB's own data, companies respond to over 98% of complaints forwarded by the Bureau.

File with your state attorney general. Most state AG offices have consumer protection divisions that handle banking complaints. This adds a second layer of regulatory pressure.

Consider small claims court. Under the EFTA (15 U.S.C. §1693m), you can sue your bank for:

• Actual damages
• Statutory damages between $100 and $1,000
• Attorney's fees and court costs

You don't need a lawyer for small claims court, and the filing fees are typically $30–$75.

Why This Matters More in 2026

According to a March 2026 MX Technologies survey, 62% of Americans currently live paycheck to paycheck and 88% reported financial stress entering the year. A U.S. News Financial Wellness Survey found that 43% of adults can't cover a $1,000 emergency expense.

When you're living on that margin, an unauthorized $500 charge isn't an inconvenience — it's a crisis. It means missed rent, late bills, and overdraft fees that compound the original fraud.

That's exactly why Regulation E's provisional credit requirement exists. The law recognizes that during the weeks it takes to investigate fraud, consumers still need to pay for groceries, gas, and rent. You shouldn't have to choose between fighting fraud and feeding your family.

The 7% of fraud victims who never received a refund — according to the Security.org survey — likely includes many people who simply didn't know they could escalate through the CFPB, didn't invoke Regulation E by name, or reported too late and exceeded the liability windows.

Knowing the law is the difference between waiting helplessly and getting your money back within 10 days.

Know the Law, Protect Your Money

Regulation E exists specifically so that unauthorized charges don't wreck your finances while the bank takes its time. The 10-day investigation window, the mandatory provisional credit, the liability caps — these are legal rights you already have. You just need to know they exist and cite them by name when you call.

Check your bank statements regularly. Report unauthorized charges within 2 business days. Reference Regulation E and 12 CFR §1005.11. And if your bank doesn't follow through, the CFPB is one complaint form away.

Your money. Your rights. Use them.