15 U.S.C. § 1693 et seq.; 12 C.F.R. pt. 1005
EFTA: getting your money back after an unauthorized electronic transfer
A claim in United States district courts · Last verified August 26, 2026
Money left your account and you did not authorise it. The Electronic Fund Transfer Act is the statute that makes the bank look into it — and, unusually, it puts the burden on the bank to prove the transfer was authorised, not on you to prove it was not.
Two deadlines govern, and they do different jobs. Sixty days to notify the bank, which is what triggers its duty and caps your liability. One year to sue. Confusing them costs people the remedy.
What the claim is
An electronic transfer left your account without your authorisation, or the bank mishandled the error you reported.
The recurring situations: a stolen or skimmed debit card; ACH debits you never set up; a recurring payment you cancelled that kept running; account takeover; and increasingly, disputes over consumer-initiated wires and person-to-person payment apps.
The claim also covers the error-resolution process itself — a bank that acknowledged your report and then did nothing, or investigated in a way that was not a real investigation.
Where the right comes from
Express. The statute states its purpose as providing "a basic framework establishing the rights, liabilities, and responsibilities of participants in electronic fund and remittance transfer systems," and a separate section creates civil liability. Regulation E implements it and supplies most of the operating detail.
What a plaintiff has to prove
- An electronic fund transfer from your account.
- That was unauthorized, or was an error as the regulation defines it.
- You gave notice.
- The institution failed to investigate, recredit, or otherwise comply.
Element two carries a burden allocation worth knowing. On an unauthorized-transfer claim the financial institution bears the burden of proving the transfer was authorised. That inverts the usual posture and is the single most useful fact on this page for a consumer.
There is no notable circuit split on the core elements.
How long you have to file
One year from the occurrence of the violation. Equitable tolling is available.
That is not the 60-day window, and the two are constantly confused. The 60 days runs from the transmittal of the periodic statement first showing the error, and it does two things: it caps your liability for the unauthorized transfer, and it triggers the institution's duty to investigate and recredit.
Missing the 60 days does not by itself bar a later suit on a distinct violation. What it forfeits is the recredit remedy tied to the error-resolution process — which, in practice, is what you came for.
What has to happen before you file
Notify the institution within 60 days.
Character: this is a substantive element of the error-resolution claim, not a gate to the courthouse. Without timely notice the institution's error-resolution duty never arises, so there is no violation to sue over. There is nothing to "cure" later.
As to the liability cap, the same 60 days behaves like a substantive right that expires — the protection lapses on its own terms.
There is no administrative exhaustion requirement. You do not have to complain to a regulator first.
Who can be sued — and who cannot
The account-holding financial institution, and in some arrangements the transfer service.
No individual-employee liability. No sovereign immunity question in an ordinary consumer case.
Common defenses
The transfer was authorised — the central fight, and the bank carries it.
Notice was untimely.
The item is not an electronic fund transfer within the statute.
The one-year bar.
Bona fide error and good-faith compliance with an official interpretation.
What the claim pays
Actual damages.
Statutory damages of $100 to $1,000 in an individual action. Class recoveries are capped at the lesser of $500,000 or 1% of the institution's net worth.
Costs and reasonable attorney's fees.
Treble damages exist, but they are not the general remedy — and this is where sources go wrong. Trebling applies only in defined circumstances: where the institution failed to provisionally recredit within the ten-day period and either did not make a good-faith investigation or lacked a reasonable basis for believing the account was not in error; or where it knowingly and willfully concluded the account was not in error when the evidence could not reasonably support that.
In other words, trebling punishes a bad investigation, not the underlying unauthorized transfer.
What people get wrong
"I have 60 days to sue." No. Sixty days to notify the bank; one year to sue.
"I have to prove I didn't authorise it." No. The institution bears the burden of proving the transfer was authorised.
"Treble damages are automatic." No. They turn on the failure to provisionally recredit plus a bad or unreasonable investigation.
"Wire transfers are never covered." Not a safe assumption. Regulatory positions and recent case law recognise that the statute can reach some consumer-initiated wires and payment-app transfers.
"I have to complain to a regulator first." You do not.
Where it came from
The statute was enacted in 1978, as part of the consumer credit legislation of that era, when automated teller machines were new and nobody had settled who bears the loss when a machine moves money it should not have. Congress's answer was to place the investigative burden on the institution and cap consumer liability for prompt reporting.
Rulemaking moved from the Federal Reserve to the Consumer Financial Protection Bureau in 2010.
The pressure point now is scope. Payment apps, real-time transfers, and fraud that induces the consumer to authorise a transfer themselves all sit at the edges of a statute written for ATM cards. Agency guidance in this area has been active and may move within a year.
Common questions
How long do I have to report an unauthorized charge to my bank?
Sixty days from the transmittal of the statement first showing it. That deadline caps your liability and triggers the bank's duty to investigate and recredit.
Is 60 days also my deadline to sue?
No. You have one year from the violation to file suit, and equitable tolling is available. The two clocks are routinely confused.
Who has to prove whether I authorised the transfer?
The financial institution. On an unauthorized-transfer claim it bears the burden of proving the transfer was authorised.
Can I get triple damages?
Only in narrow circumstances — where the bank failed to provisionally recredit within ten days and either did not make a good-faith investigation or had no reasonable basis for its conclusion, or where it knowingly and willfully found no error against the evidence.
Does this cover Zelle, wires, or payment apps?
Sometimes. The statute was written for card and ACH transfers, but regulatory positions and case law recognise it can reach some consumer-initiated wires and app-based transfers. This is the most unsettled part of the statute.