What Is Regulation E? Your Rights When an Electronic Payment Goes Wrong

Most people never hear the words "Regulation E" until something goes wrong. A charge appears that you did not make. A recurring payment hits after you tried to cancel it. A bank teller mentions it while explaining why your dispute refund can be clawed back. Behind all of those moments sits one quiet set of federal rules that decides how much fraud can cost you and how fast your bank has to respond when you flag a mistake.

Regulation E is the rule that carries out a 1978 law called the Electronic Fund Transfer Act. It applies to the everyday electronic money movements that now make up most of our financial lives: debit card purchases, ATM withdrawals, direct deposits, automatic bill payments, and transfers you start through a bank app or website. If you have ever tapped a card, split a utility bill through autopay, or watched a paycheck land before you woke up, Regulation E was working in the background the whole time.

This guide walks through what the rule covers, what it pointedly does not, the dollar limits on your liability when a card or account is used without permission, and the deadlines that both you and your bank are expected to meet. None of this is legal advice, and the exact handling of any single case can turn on details, but understanding the framework puts you in a far stronger position the day you actually need it.

What Regulation E actually covers

The rule is built around a specific phrase: the electronic fund transfer, often shortened to EFT. An EFT is money moved into or out of your account by electronic means rather than by a paper check or physical cash handoff. According to the Consumer Financial Protection Bureau's text of Regulation E, that umbrella stretches across a wide range of common transactions.

Covered transfers include debit card purchases at a store or online, point-of-sale swipes and taps, ATM deposits and withdrawals, direct deposit of wages or government benefits, automatic withdrawals set up to pay a loan or subscription, transfers you initiate by phone through an automated system, and transfers you move through online or mobile banking. Since 2019, the rule has also extended many of the same protections to prepaid accounts, including general purpose reloadable cards and certain digital wallets that store funds.

What ties these together is that the account involved is generally a consumer account used for personal, family, or household purposes. Business accounts usually fall outside the consumer protections, which is one reason the rules for a company checking account can look very different from the rules for your personal one.

What Regulation E does not cover

Just as important as the list of covered transfers is the list of things that sit outside the rule, and the boundary around paper checks is more nuanced than many people assume. A paper check itself is not an electronic fund transfer. The electronic processing of a check through the check collection system is also not an EFT, so when your bank and the payee's bank exchange an electronic image of your check for presentment and payment, that activity stays under check and UCC rules rather than Regulation E.

There is an important exception, though. When a merchant or biller uses the information from your check, such as the account and routing numbers, to initiate a separate one-time electronic debit from your account, that converted transfer is treated as an EFT and is covered by Regulation E under section 1005.3(b)(2). This is often called ACH check conversion, and you may have authorized it by handing a check to a cashier who scanned and returned it, or by dropping a check in a biller's lockbox. The dividing line is whether your check moves through the check collection system as a check, or whether its details are used to launch a new electronic payment. The former sits outside the rule; the latter sits inside it.

Credit card transactions are governed by a different rulebook, Regulation Z and the Fair Credit Billing Act, which carry their own dispute rights and liability caps. Wire transfers are a notable gray zone. Traditional high-value wires have historically been treated as outside Regulation E, which is part of why recovering a wire you sent by mistake is so difficult compared to reversing a card charge. Certain smaller consumer transfers sent abroad are instead handled under the remittance transfer rules, a separate subpart of Regulation E with its own disclosure and error-resolution scheme.

The table below lays out the broad split so you can tell at a glance which bucket a given payment is likely to fall into. Treat it as a starting map rather than a legal ruling on any single transaction.

The liability limits that matter most

The single most valuable thing Regulation E gives consumers is a cap on how much an unauthorized electronic transfer can cost them. An unauthorized transfer is one made from your account without your permission and from which you receive no benefit. If a thief grabs your card number or your lost card is used at an ATM, the rule decides how much of that loss can land on you, and the answer depends heavily on how quickly you speak up.

The CFPB's text of Regulation E section 1005.6 sets out three tiers of potential liability when the fraud involves a lost or stolen access device such as a debit card:

• Up to $50. If you notify your financial institution within two business days of learning about the loss or theft, your liability is capped at the lesser of $50 or the amount of the unauthorized transfers that happened before you gave notice.
• Up to $500. If you wait longer than two business days to report the lost or stolen device, your exposure can rise. The rule lets the institution hold you responsible for up to $500, built from the first $50 tier plus additional unauthorized transfers that occurred after the two-day window but before you reported.
• Unlimited for later transfers. If an unauthorized transfer shows up on your periodic statement and you do not report it within 60 days of the statement being sent, you can be on the hook for the transfers that happen after that 60-day mark, when the institution can show they could have been stopped had you spoken up in time.

There is an important wrinkle when no physical device is lost. If a criminal uses only your card number, with the card itself still in your wallet, the two-business-day rule does not apply. In that situation the focus shifts to the 60-day statement window: report unauthorized transfers within 60 days of the statement that first shows them and your liability for those transfers is generally zero. The rule also recognizes that life happens, allowing the time limits to be extended when a delay was caused by extenuating circumstances such as an extended hospital stay.

It is worth noting that many banks and card networks voluntarily offer zero liability policies that are more generous than the legal floor Regulation E sets. Those policies are a business choice layered on top of the law, and they can carry their own conditions, so the regulation remains your baseline protection rather than your only one.

How the timing math plays out

Because the dollar figures hinge on calendar timing, the difference between reporting today and reporting next month can be large. The chart below shows a purely hypothetical illustration. Imagine a thief runs several unauthorized ATM withdrawals after taking a card, and compare the ceiling on what the account holder might owe under each reporting scenario. The numbers are illustrative, not a promise about any real case, since actual liability depends on when each transfer posted and what the institution can establish.

The takeaway from that illustration is simple and consistent with the rule: speed is your cheapest protection. Checking your account regularly and reporting anything unfamiliar right away keeps you in the lowest liability tier, where the worst-case cost is small.

The error resolution clock

Regulation E does not only cap your losses. It also puts your bank on a defined timeline once you report a problem. This is the part of the rule that governs disputes over everything from a double charge to a withdrawal you never made. The framework lives in section 1005.11 and is summarized in guidance such as the NCUA's consumer compliance guide to Electronic Fund Transfers.

Your first job as the consumer is to give notice of the error. You generally must do this within 60 days of the institution sending the statement that shows the problem transaction. You can usually report orally, by phone, though the bank is allowed to ask you to follow up in writing.

Once the institution receives your notice, its clock starts. The core deadlines work like this:

The relationship between the 10-day investigation window and the 45-day extension is the hinge of the whole process, and it is a point banks themselves sometimes get wrong. An institution that cannot finish investigating within 10 business days is allowed to take up to 45 calendar days, but generally only if it provisionally credits the disputed amount to your account within those 10 business days and tells you about it, typically within two business days of making the credit. There is a meaningful exception. If the bank asked you to confirm an orally reported error in writing and you do not provide that written confirmation within 10 business days, the institution may take the longer period even without issuing provisional credit (a similar carve-out applies to accounts subject to the securities margin rules under Regulation T). Even then, the bank must begin investigating promptly on your oral notice rather than waiting for the paperwork. A recent Federal Reserve examiner review flagged error-resolution timing as one of the most frequently cited Regulation E problems, pointing to delayed investigations after oral notices and failures to provide required provisional credit on time.

Some transactions get a longer leash. The 45-day outer limit can stretch to 90 days for a point-of-sale debit card transaction, a transfer initiated outside the United States, or a transfer that occurs on a new account. The new-account trigger is specific: under section 1005.11(c)(3) it applies when the disputed transfer takes place within 30 days after the first deposit to the account, not from when the account was opened and not from when you report. For those new-account transfers, the rule also lengthens the front end, giving the bank up to 20 business days rather than 10 for both its initial investigation and for delivering any provisional credit.

When the investigation ends, the institution must tell you the result within three business days. If it confirms an error, it has to correct it, typically crediting the money within one business day of reaching that conclusion.

Provisional credit and when it gets reversed

Provisional credit is one of the most misunderstood pieces of this process. It is not a final decision in your favor. It is a temporary deposit that gives you use of the disputed funds while the bank investigates, so you are not left short for weeks over a transaction you say you never made. Because it is temporary, it can be taken back.

If the institution ultimately decides no error occurred, it may reverse the provisional credit. The rule does not require the bank to give you advance warning before the debit. Under section 1005.11(d)(2), the institution may notify you of the date and amount of the debiting at the time it debits your account, and giving advance notice is simply an alternative procedure the bank is allowed to choose instead. What the rule does require is a cushion built around the debit. For five business days after that notification, the institution must honor checks, drafts, and preauthorized transfers payable to third parties that would have been paid had the provisional funds stayed in place, and it cannot impose overdraft charges on those specific items.

That protection is narrow. It covers only those specified checks and preauthorized transfers, and only for a short window, so it will not shield every payment you make afterward. The practical lesson is to treat provisional credit as borrowed time rather than found money. Do not spend it down to zero before the dispute is resolved, because a reversal can push your balance negative beyond the protected items and trigger the very overdraft problems you were trying to avoid.

If you disagree with the bank's conclusion, you can ask for the documents it relied on. The institution is required to provide copies of the materials used in its determination when you request them, which can help you decide whether to escalate the matter.

Stopping recurring payments you authorized

Regulation E also addresses a different headache: the recurring payment that you did originally agree to but now want to end. A preauthorized electronic fund transfer is one you set up to recur at roughly regular intervals, such as a monthly gym charge, a streaming subscription billed to your debit card, or an automatic loan payment pulled from your account.

Under section 1005.10, you have the right to stop payment on one of these transfers by notifying your financial institution, orally or in writing, at least three business days before the scheduled date. Importantly, this right applies to recurring debit card charges as well as recurring ACH debits, so a subscription billed to your card is covered even though it feels different from a bank draft.

Two practical details matter here. First, stopping the bank payment is not the same as canceling the underlying contract. If you owe the merchant money, halting the transfer may stop the charge but will not erase the obligation, and the merchant may pursue it another way. It is usually wise to cancel with the merchant directly and use the bank stop-payment right as a backstop. Second, when you place the stop order orally, the institution may require you to confirm it in writing within 14 days, and an oral order can stop being binding after that window if you do not send the confirmation. If a bank fails to honor a valid and timely stop-payment order, the rule can make it liable for your resulting losses.

If the recurring payment amount changes from one cycle to the next, the rule generally entitles you to advance notice of the new amount before it is pulled, giving you a chance to react if a charge jumps unexpectedly.

Receipts, statements, and disclosures

Several less dramatic parts of Regulation E quietly support everything above. The rule requires institutions to give you certain disclosures when you open an account, including a plain summary of your liability for unauthorized transfers, the phone number and address to use for reporting them, the institution's business days, and your error-resolution rights. That disclosure is the document you want to dig out the moment a problem appears, because it tells you exactly where and how to report.

The rule also governs receipts and statements. You are generally entitled to a receipt for transfers made at an electronic terminal such as an ATM or a store terminal, and to periodic statements that document your electronic activity. Those statements are not just paperwork. They are the trigger for the 60-day reporting windows that decide your liability and your dispute rights, which is a strong reason to actually read them. If you want a refresher on spotting problems line by line, our guide to reading a bank statement without missing fees walks through the habit in detail.

Building a buffer against reversals and gaps

Regulation E can win your money back, but almost never on the same day. Between the moment fraud hits and the moment a dispute closes, you may be living with less in your account than your statement first promised. Provisional credit can soften that gap, yet it is reversible, and the outer investigation windows of 45 or even 90 days are long enough for an unlucky reversal or a slow refund to collide with rent, a car payment, or an automatic draft that bounces. The rule governs how the dispute is handled; it does nothing to pad your balance while the clock runs.

That is why a modest cash cushion is a practical companion to all the rights described above. If a reversed provisional credit or a pending claim cannot knock your usable balance below your fixed bills, a dispute becomes an annoyance rather than a crisis, and you avoid stacking overdraft or returned-payment fees on top of the original loss. The calculator below is a hypothetical planning tool, not a forecast. Enter your essential monthly expenses, how many months of coverage you want to hold, what you have saved now, and what you can set aside each month, and it will sketch how a buffer could build over time.

There is no single correct target here. Someone whose income arrives through a single direct deposit, or who relies heavily on debit transactions, may want a larger buffer than someone with other accounts to fall back on. The point is simply that your legal rights and your own liquidity work together: the regulation sets the deadlines and the caps, and a buffer keeps you solvent while those deadlines play out.

Where Regulation E runs out of road

The protections are powerful, but they have edges worth knowing. The clearest one is the line between unauthorized and authorized transfers. Regulation E protects you when money leaves your account without your permission. It generally does not rescue you when you were tricked into authorizing the payment yourself. If a scammer convinces you to send money through a peer-to-peer app or to approve a transfer, many institutions take the position that the transfer was authorized, even though you were deceived, which places it outside the classic unauthorized-transfer protections. This distinction is at the heart of ongoing debate about scams on payment apps, and it is why consumer advocates urge treating any request to move money fast and irreversibly with deep suspicion.

The rule also does not guarantee a particular outcome. It guarantees a process: deadlines, a good-faith investigation, provisional credit in the right circumstances, and disclosure of the evidence. The bank can still conclude that no error occurred, and you may need to escalate through a complaint to the CFPB or your prudential regulator, or seek your own legal advice, if you believe the determination was wrong. Keeping your own record of dates and conversations is what turns a vague grievance into a documented timeline an examiner or complaint handler can act on.

Finally, remember that the regulation sets a floor, not a ceiling. Banks can and do offer stronger protections, and reading your account's own disclosures is part of knowing what you actually have. Staying on top of recurring charges and watching your transactions closely is practical day-to-day work, and a tool like WalletHub Premium offers features such as automatic expense tracking and a subscription manager that gathers your recurring transactions in one place, which can make it easier to catch a charge you meant to cancel. Those tools sit alongside the baseline rights every covered account already carries by law.

Putting it to work

You do not need to memorize section numbers to benefit from Regulation E. A few habits capture most of its value. Check your account often enough that an unfamiliar charge cannot hide for weeks. Report anything suspicious the moment you see it, by phone, and follow up in writing if asked, so you stay in the lowest liability tier. Keep notes on when you reported, who you spoke with, and what you were told, because the deadlines run from specific dates. Treat provisional credit as temporary until the investigation closes. And when you want to end a recurring charge, give at least three business days of notice and confirm in writing.

Electronic payments have made moving money almost frictionless, and that convenience cuts both ways: the same speed that lets a paycheck arrive early lets fraud move fast too. Regulation E is the counterweight. It will not stop every bad transaction, but it gives you defined limits, defined deadlines, and a defined paper trail, which is often exactly what you need to get your money back.