If someone made an unauthorized bank withdrawal from your New York account, call your bank today. Under the federal Electronic Fund Transfer Act, reporting within two business days of learning about the problem caps your liability at $50. Wait past that window and your exposure climbs to $500. Wait more than 60 days after the bank sends a statement showing the transfer, and your losses can be unlimited for anything that happens after that point.1Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability The rest of your recovery — investigation, provisional credit, fee reversals, and, if needed, regulatory complaints or a lawsuit — flows from that first phone call.
Call the Bank Before Anything Else
The Electronic Fund Transfer Act uses a tiered liability system that rewards fast reporting and penalizes delay.
- Report within two business days of learning your card or credentials were lost, stolen, or misused: liability is capped at $50, or the amount taken before you notified the bank, whichever is less.
- Report after two business days but before 60 days from the statement date: liability can rise to $500 for transfers that occurred after the two-day window closed.
- Report more than 60 days after the bank sent a statement showing the unauthorized transfer: unlimited liability for further transfers the bank can show would have been prevented by timely notice.
Even if you aren’t sure whether a charge was really unauthorized, report it. You can withdraw the claim later. You cannot recover the days you spent debating whether to pick up the phone.1Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability
Make the report by phone, then follow up in writing the same day. If the bank asks for written confirmation of your oral report, deliver it within 10 business days. Missing that written follow-up lets the bank skip a step you want it to take: provisional credit while the investigation runs.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
What the Bank Has to Do Next
Regulation E requires your bank to investigate promptly once you report an error. The bank has 10 business days to complete the investigation and report back. If it confirms an error, it must correct the account within one business day.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
If the bank needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount within those first 10 business days. You get full use of the money while the review continues. Certain categories get a longer 90-day window instead of 45: point-of-sale debit card transactions, transfers involving a foreign country, and transfers within 30 days of the first deposit to a new account.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
If the bank concludes no error occurred, it owes you a written explanation. A provisional credit can be reversed, but only after the bank notifies you. Missing deadlines, skipping provisional credit that’s due, or denying a legitimate claim without adequate explanation are federal violations you can act on.
What Counts as an Unauthorized Withdrawal
An unauthorized electronic fund transfer is one initiated by someone other than you, without your permission, and from which you received no benefit. Withdrawals with a stolen debit card, transfers made through hacked online banking, and forged checks all qualify.
New York’s version of UCC 4-401 reinforces this: a bank can only charge your account for items that are “properly payable,” meaning items you authorized. A debit you never approved is improper, and the bank is generally on the hook to restore the funds.3New York State Senate. New York Code UCC Article 4 – Part 4 – 4-406
Phishing and Stolen Credentials Still Count
If a scammer tricked you into giving up your login credentials and then drained your account, the transfer is still unauthorized under Regulation E. The Consumer Financial Protection Bureau has confirmed that a third party who fraudulently induces you to share account access and then uses it has initiated an unauthorized EFT, subject to the standard liability caps.4Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
Where the Protections Don’t Apply
A few situations look like unauthorized withdrawals but aren’t treated that way, and knowing the boundary saves you from filing a claim the bank will deny.
Joint account holders generally have full authority to withdraw. If a co-owner clears out the account, the bank has no liability because an authorized party made the withdrawal. Your remedy is against the other owner, not the bank.
Family members you handed a card to are usually treated as authorized users. If your spouse, child, or roommate used your debit card beyond what you meant to allow, Regulation E’s unauthorized-use rules generally do not apply until you notify the bank that the person no longer has permission. This catches many claimants off guard and is one of the most common reasons fraud claims get denied.
Merchant disputes — a product that arrived broken, a service you never received, a subscription you thought you canceled — are not “errors” under Regulation E. Debit card protections don’t include the withholding-payment rights that credit cards give you. The money is already out of your account, and your recourse runs against the merchant.
Get the Fees and Overdrafts Reversed Too
When an unauthorized withdrawal drains your balance, the collateral damage often costs more than the withdrawal itself. Overdraft charges, returned-payment fees, and bounced auto-pays pile up while you wait for the investigation.
Once the bank confirms the transaction was unauthorized, it must correct the full error, including any fees the fraud generated. Regulation E also prohibits the bank from charging you fees related to the error-resolution process itself. If your bank confirmed the fraud but refused to reverse the resulting overdraft or NSF fees, that refusal is itself a violation.
The withdrawal won’t appear on your credit report, but missed payments caused by the resulting shortfall can. Under the Fair Credit Reporting Act, you can dispute any inaccurate item that resulted from the unauthorized activity; credit bureaus have 30 days to investigate. If the withdrawal was tied to identity theft, filing an identity theft report at IdentityTheft.gov unlocks a stronger tool: credit bureaus must block reporting of information you identify as resulting from the theft, once you submit the report, proof of your identity, and a statement identifying the fraudulent items. That report also strengthens the record you build with your bank.
If the Bank Denies Your Claim
A denial is not the end of the road. New York and federal law give you several places to push back.
For disputes of $10,000 or less, New York City’s small claims courts hear cases without requiring a lawyer, schedule sessions during evening hours, and typically resolve matters through arbitrators.5NYCOURTS.GOV. Small Claims Court – In General
The New York State Department of Financial Services regulates state-chartered banks and takes consumer complaints. NYDFS enforces cybersecurity requirements under 23 NYCRR Part 500 and can impose penalties and require corrective action against institutions whose security failures enabled unauthorized access.6Department of Financial Services. Cybersecurity Resource Center
At the federal level, the Consumer Financial Protection Bureau accepts complaints about EFTA and Regulation E violations and has authority to investigate banks that systematically mishandle unauthorized-transfer claims.7National Credit Union Administration. Electronic Fund Transfer Act (Regulation E)
Civil Claims Under New York Law
When regulatory complaints aren’t enough, New York gives you several causes of action.
Breach of Contract
Your account agreement is a contract. If the bank processed an unauthorized transaction in violation of its own security or fraud-protection terms, you can sue for breach and, where applicable, consequential damages tied to overdraft fees, late-payment penalties, or other financial harm that flowed from the failure. New York’s statute of limitations for contract claims is six years.8NYCOURTS.GOV. Statute of Limitations Chart
Deceptive Practices Under GBL 349
New York General Business Law Section 349 prohibits deceptive business practices. A bank that misrepresented its security measures or failed to follow its own fraud-prevention protocols can be sued privately. Prevailing plaintiffs recover actual damages or $50, whichever is greater, plus reasonable attorney’s fees. A court that finds a willful or knowing violation can award up to three times actual damages, capped at $1,000 for the enhanced portion.9New York State Senate. New York General Business Law 349
Negligence
A negligence claim may be available if the bank ignored red flags such as unusual withdrawal patterns or transactions inconsistent with your normal activity. Courts look at whether the bank followed industry-standard fraud-detection practices. Proving negligence can support damages beyond the statutory remedies.
The Filing Clock
Both breach of contract and fraud claims in New York carry a six-year statute of limitations. For fraud, the clock can run from either the date of the act or the date you reasonably should have discovered it. Sitting on suspicious statements doesn’t just raise your Regulation E liability; it can also cost you the civil claim.8NYCOURTS.GOV. Statute of Limitations Chart
The Deadlines You Can’t Miss
New York’s version of UCC 4-406 places an independent duty on you to review bank statements with reasonable promptness. For unauthorized signatures or altered checks, the outer deadline to report is one year from when the bank made the statement available. For unauthorized endorsements, it’s three years. Miss those windows and you lose the right to assert the claim against the bank.3New York State Senate. New York Code UCC Article 4 – Part 4 – 4-406
Those UCC deadlines cover paper-based transactions like forged checks. For electronic fund transfers, the controlling deadline is Regulation E’s 60-day window from the statement showing the unauthorized transfer. Many account agreements set their own, shorter reporting periods, so read the terms.1Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability
One nuance worth knowing: even if you miss a reporting deadline, the bank does not automatically walk away. A bank whose own negligence contributed to the loss — for example, by repeatedly processing obviously forged checks without basic verification — can still be held partly responsible. Courts weigh customer delay against the bank’s failure to exercise ordinary care.
A Note on Business Accounts
The protections above apply to consumer accounts opened primarily for personal, family, or household use. Business accounts are excluded from Regulation E and the EFTA entirely.10eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E)
Business wire transfers are governed by UCC Article 4-A. Under Section 4A-202, a bank avoids liability for an unauthorized wire transfer if it followed a “commercially reasonable” security procedure agreed to by both parties, and the transfer was verified under that procedure. Whether a procedure qualifies as commercially reasonable turns on the size and frequency of the business’s typical transactions, the options the bank offered, and what similarly situated banks and customers use. Declining a stronger security procedure in favor of convenience can shift the loss to the business if a fraudulent transfer later occurs.11Legal Information Institute. UCC 4A-202 – Authorized and Verified Payment Orders