Bank Refused Your Scam Refund? How to Challenge a Fraud Claim Denial

If your bank, card issuer or payment app refused to refund money you lost to a scam, start with one question: did the scammer move the money, or did you send it yourself? Federal law requires a bank to investigate and correct an unauthorized electronic transfer, and the Consumer Financial Protection Bureau (CFPB) says that includes money a scammer moved after tricking you into sharing your login, a texted code or your debit card number. A payment you sent yourself generally falls outside Regulation E's definition of an unauthorized transfer, so a denial in that case may reflect the bank's policy rather than a broken rule.

Either way, a denial is not the last word. After finding no error, a bank must send a written explanation and tell you that you can request the documents it relied on (12 C.F.R. § 1005.11(d)(1)). A credit card issuer must explain its reasons and, on request, furnish documentary evidence (12 C.F.R. § 1026.13(f)). From there you can push back in writing, complain to the CFPB and to your bank's own federal regulator, and, if the bank did not follow the law, sue within one year (15 U.S.C. §§ 1693m(g), 1640(e)).

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This article covers US federal law: the Electronic Fund Transfer Act (EFTA) and Regulation E for bank accounts, debit cards and payment apps, and the Truth in Lending Act, Fair Credit Billing Act and Regulation Z for credit cards, plus federal complaint routes. It does not cover state banking regulators, state small claims limits, state consumer-protection laws or card-network chargeback rules. For refund rights by payment method before a claim is filed, see how to get money back after a scam.

Step 1: Work out what kind of denial you got

Banks deny scam claims for different reasons, and each reason points to a different next move. Find the row that matches what happened.

If the scammer moved the money

Regulation E protects you against transfers you did not make. The CFPB's Regulation E guidance defines the term this way:

"An unauthorized EFT is an EFT from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit. 12 CFR 1005.2(m)."

Banks sometimes deny a claim because you gave the scammer your card or code. The regulation does exclude transfers by someone you furnished your access device to, but the CFPB's guidance adds that "This exclusion does not apply to transfers initiated by a person who obtained a consumer's access device through fraud or robbery." The official commentary says the same: "An unauthorized EFT includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery" (Supplement I to Part 1005, comment 2(m)-3).

The CFPB applies that rule directly to common scams. When "a consumer is fraudulently induced into sharing account access information with a third party, and a third party uses that information to make an EFT from the consumer's account, the transfer is an unauthorized EFT under Regulation E." Its examples are a caller "pretending to be a representative from the consumer's financial institution" who tricks the consumer into providing "their account login information, texted account confirmation code, debit card number," and a scammer who uses phishing to "observe the consumer entering account login information."

Three more points from the same CFPB guidance answer common reasons for denial:

• "You were careless." Regulation E's commentary "expressly states that negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E." The commentary adds that "no agreement between the consumer and an institution may impose greater liability on the consumer for an unauthorized transfer than the limits provided in Regulation E" (comment 6(b)-3).
• "Contact the merchant first." Asked whether a bank can require that, the CFPB answers "No," because a bank "must begin its investigation promptly upon receipt of an oral or written notice of error and may not delay initiating or completing an investigation pending receipt of information from the consumer."
• "The payment network says transfers are final." Network rules on finality "do not reduce consumer protections against liability for unauthorized EFTs," and "no agreement between a consumer and any other person may waive any right provided by the EFTA. See 15 USC 1693l."

If you sent the money yourself

If you personally sent the payment, the transfer was initiated by you, not by "a person other than the consumer." As written, the definition generally does not reach that payment, and banks and apps often treat it as authorized. The CFPB guidance reviewed for this article does not address that situation, so we do not say the bank was required to refund it.

That makes the rest of this guide less useful to you, though not useless. You can still ask for the bank's explanation, complain to the CFPB and the bank's regulator, and ask whether any voluntary reimbursement policy applies. Our guide to Zelle and payment app scams covers the policies some providers have adopted for payments you authorized.

What your bank must give you after it says no

Bank accounts, debit cards and payment apps (Regulation E)

These rules bind any "financial institution," which the CFPB notes includes "a bank, savings association, credit union, or any other person that directly or indirectly holds an account belonging to a consumer" (12 C.F.R. § 1005.2(i)). A payment app that holds your balance can fall within that definition.

When a bank finds no error, or an error different from the one you reported, Regulation E sets out what it owes you:

"The institution's report of the results of its investigation shall include a written explanation of the institution's findings and shall note the consumer's right to request the documents that the institution relied on in making its determination. Upon request, the institution shall promptly provide copies of the documents." (12 C.F.R. § 1005.11(d)(1))

The statute behind that rule sets the timing. The bank "shall deliver or mail to the consumer an explanation of its findings within 3 business days after the conclusion of its investigation, and upon request of the consumer promptly deliver or mail to the consumer reproductions of all documents which the financial institution relied on to conclude that such error did not occur" (15 U.S.C. § 1693f(d)).

The investigation itself has deadlines. The bank must decide within 10 business days, or it may take up to 45 days if it "Provisionally credits the consumer's account in the amount of the alleged error (including interest where applicable) within 10 business days of receiving the error notice" (12 C.F.R. § 1005.11(c)(1)-(2)). The longer period becomes 90 days for a point-of-sale debit card transaction, a transfer not initiated within a state, or a transfer within 30 days after the first deposit to a new account (§ 1005.11(c)(3)). For that new-account case, the 10-business-day periods also become 20 business days (§ 1005.11(c)(3)(i)). Compare those dates with the dates on your denial letter.

The investigation can be thin. Except for transfers covered by § 1005.14, when the disputed transfer went to a third party and the bank has no agreement with that party for that type of transfer, "a financial institution's review of its own records regarding an alleged error satisfies the requirements of this section" (§ 1005.11(c)(4)). That is one reason the facts you put in writing matter.

If the bank takes back a provisional credit, it must tell you the date and amount, and tell you it "will honor checks, drafts, or similar instruments payable to third parties and preauthorized transfers from the consumer's account (without charge to the consumer as a result of an overdraft) for five business days after the notification" (§ 1005.11(d)(2)). Use those five business days to move upcoming payments if the reversal will leave your balance short.

Credit cards (Regulation Z)

If a card issuer concludes, "after conducting a reasonable investigation," that no billing error occurred, it must "Mail or deliver to the consumer an explanation that sets forth the reasons for the creditor's belief that the billing error alleged by the consumer is incorrect in whole or in part" and "Furnish copies of documentary evidence of the consumer's indebtedness, if the consumer so requests" (12 C.F.R. § 1026.13(f)). That is narrower than the bank rule: the issuer owes you evidence that you owe the charge, not every document it relied on.

After the denial, the issuer "Shall promptly notify the consumer in writing of the time when payment is due and the portion of the disputed amount and related finance or other charges that the consumer still owes" (§ 1026.13(g)(1)). It may report the amount as delinquent only after the disclosed payment period "or 10 days (whichever is longer)" (§ 1026.13(g)(3)).

Your credit report gets extra protection if you keep disputing. If the issuer receives, within the time allowed for payment, "further written notice from the consumer that any portion of the billing error is still in dispute," it may not report the amount as delinquent unless it also "(i) Promptly reports that the amount or account is in dispute; (ii) Mails or delivers to the consumer (at the same time the report is made) a written notice of the name and address of each person to whom the creditor makes a report; and (iii) Promptly reports any subsequent resolution of the reported delinquency to all persons to whom the creditor has made a report" (§ 1026.13(g)(4)). The Fair Credit Billing Act contains the same protection (15 U.S.C. § 1666a(b)-(c)).

While a billing error is still being resolved, you "need not pay (and the creditor may not try to collect)" the disputed portion, and the issuer may not "make or threaten to make an adverse report to any person about the consumer's credit standing" because you did not pay it (§ 1026.13(d)(1)-(2)).

How to push back in writing

A written challenge works best when it gives the bank something it did not have. The law does not force a bank to start over: a bank "that has fully complied with the error resolution requirements has no further responsibilities under this section should the consumer later reassert the same error" (12 C.F.R. § 1005.11(e)). Card issuers have the same limit for "substantially the same billing error" (12 C.F.R. § 1026.13(h)). Any second look is therefore up to the bank, unless the bank did not follow the rules the first time.

1. Request the documents in writing. Ask for copies of the documents the bank relied on (Regulation E) or the documentary evidence of what you owe (Regulation Z). Keep a copy of your request and note the date you sent it.
2. Read the explanation against what happened. Look for the specific reason. Did the bank say you authorized the transfer? Did it say your notice was late? Did it treat the loss as a payment you made rather than one a scammer made?
3. Correct the facts, with dates. If the bank called a transfer authorized because you shared a code or login with an impostor, say exactly how the scammer got it and who moved the money. That is the situation the CFPB guidance quoted above treats as unauthorized, and the commentary on fraud (comment 2(m)-3) and negligence (comment 6(b)-2) applies.
4. Point to anything the bank missed. Police or FTC report numbers, call logs, texts from the impostor, and the time you first reported the loss all belong in the letter.
5. For a credit card, dispute again within the payment period. Sending further written notice before the payment deadline in the denial triggers the credit-reporting protections in § 1026.13(g)(4).
6. Keep a file. Save the denial, every letter, and a log of each call with the date, time and name of the person you spoke with.

One exception to the reassertion rule is worth knowing. Regulation E treats as an "error" your "request for documentation ... or for additional information or clarification concerning an electronic fund transfer, including a request the consumer makes to determine whether an error exists" (§ 1005.11(a)(1)(vii)). A notice of error based on information you requested that way "is timely if received by the financial institution no later than 60 days after the institution sends the information requested" (§ 1005.11(b)(3)), and the reassertion limit does not apply to "an error asserted by the consumer following receipt of information provided under paragraph (a)(1)(vii)" (§ 1005.11(e)). Whether that exception fits your case depends on what you asked for and what the bank sent, so it is a good question for a lawyer.

Pro tip: describe the scam in plain words, in order, and keep the letter to the facts. A clear timeline of who did what, and when you reported it, is also what you will reuse for a regulator complaint or a court filing.

Escalate to the CFPB

The CFPB accepts complaints about financial products and services at consumerfinance.gov/complaint. It says it sends complaints to companies for a response, that "Most companies respond within 15 days," and that it will send your complaint to another agency if that agency would be better able to help. Include everything in the first complaint, because "you generally can't submit a second complaint about the same problem."

If you cannot file online, the CFPB's complaint page lists a phone line, (855) 411-2372 (TTY/TDD (855) 729-2372), 9 a.m. to 6 p.m. Eastern, Monday through Friday except federal holidays.

Be realistic about what a complaint does. The CFPB sends it to the company and the company responds; a complaint is not a lawsuit, and the CFPB's complaint page does not promise a refund.

Escalate to your bank's own regulator

Your bank or credit union's federal regulator also takes complaints, and which regulator that is depends on how the institution is chartered. The FDIC, for example, describes its consumer division as "responsible for enforcing federal consumer protection laws and regulations at state-chartered banks that are not members of the Federal Reserve System."

How to tell which applies: the Federal Reserve's complaint page points readers to the FFIEC's Consumer Help Center to "Find out who regulates your bank." If you are unsure, file with the CFPB, which says it will send a complaint to another agency that is better able to help, and the Federal Reserve says it "may connect you with or forward your complaint to another federal regulator."

What the regulators say they do is modest. The Federal Reserve says that "Although the Federal Reserve looks into every complaint that involves banks it regulates, it does not have the authority to resolve every problem." The NCUA recommends "trying to resolve the dispute directly with your credit union" first, then asks "the credit union attempt to resolve your complaint within 60 calendar days." If you disagree that the credit union resolved it, you can dispute that "by contacting the CAC in writing within 30 calendar days of the date of the credit union's response letter," which may lead to a formal investigation.

Your state attorney general's office also takes consumer complaints; the National Association of Attorneys General keeps a directory of every state attorney general.

Small claims court

The federal statutes do not limit you to federal court. A claim under the EFTA "may be brought in any United States district court, or in any other court of competent jurisdiction" (15 U.S.C. § 1693m(g)), and the Truth in Lending Act uses the same words (15 U.S.C. § 1640(e)). Whether your state's small claims court can hear such a claim, and up to what dollar amount, depends on state rules this article does not cover; ask the court clerk.

If your account agreement has an arbitration clause, look for a small claims exception. The CFPB's 2017 arbitration rule, summarizing its 2015 study, said the study found that "most of the arbitration agreements contained a small claims court 'carve-out,' permitting either the consumer or both parties to file suit in small claims court." That was a finding about agreements in general, so read your own.

A small claims case still turns on proof. Bring the denial letter, the documents the bank sent, your written challenge, and your timeline.

When a lawsuit under the EFTA or TILA makes sense

A lawsuit makes the most sense when the bank or issuer did not follow the error-resolution rules: it missed the deadlines, skipped provisional credit, never explained its denial, refused the documents, or ignored facts that show the transfer was unauthorized. It is a claim against a company that broke the rules, not a general right to be repaid for a scam.

Electronic Fund Transfer Act

Under 15 U.S.C. § 1693m(a), "any person who fails to comply with any provision of this subchapter with respect to any consumer, except for an error resolved in accordance with section 1693f of this title, is liable to such consumer" for:

• "any actual damage sustained by such consumer as a result of such failure";
• "in the case of an individual action, an amount not less than $100 nor greater than $1,000"; and
• "in the case of any successful action to enforce the foregoing liability, the costs of the action, together with a reasonable attorney's fee as determined by the court."

Note the carve-out for "an error resolved in accordance with section 1693f." How courts apply it when a bank followed the procedure but reached a disputed result is a question this article did not research.

Treble damages. The EFTA allows triple damages only in specific circumstances. Section 1693f(e) provides:

"If in any action under section 1693m of this title, the court finds that ... (1) the financial institution did not provisionally recredit a consumer's account within the ten-day period specified in subsection (c), and the financial institution (A) did not make a good faith investigation of the alleged error, or (B) did not have a reasonable basis for believing that the consumer's account was not in error; or (2) the financial institution knowingly and willfully concluded that the consumer's account was not in error when such conclusion could not reasonably have been drawn from the evidence available to the financial institution at the time of its investigation, then the consumer shall be entitled to treble damages determined under section 1693m(a)(1) of this title."

That gives two separate routes. The first needs both a missed ten-day provisional recredit and either no good-faith investigation or no reasonable basis for the denial. The second needs a court finding that the bank "knowingly and willfully" reached a conclusion the evidence could not reasonably support. Either way, what is tripled is actual damage under § 1693m(a)(1). A denial alone does not trigger it.

The statute also gives banks defenses. A bank is not liable if the violation "was not intentional and resulted from a bona fide error notwithstanding the maintenance of procedures reasonably adapted to avoid any such error" (§ 1693m(c)), or if, before you sue, it "notifies the consumer concerned of the failure, complies with the requirements of this subchapter, and makes an appropriate adjustment to the consumer's account and pays actual damages" (§ 1693m(e)). If a court finds an unsuccessful suit "was brought in bad faith or for purposes of harassment," it "shall award to the defendant attorney's fees" (§ 1693m(f)).

Truth in Lending Act (credit cards)

Under 15 U.S.C. § 1640(a), "any creditor who fails to comply with any requirement imposed under this part," including part D of the subchapter, which contains the Fair Credit Billing Act's billing-error rules, is liable for "any actual damage sustained by such person as a result of the failure," statutory damages that vary by type of credit, and, "in the case of any successful action to enforce the foregoing liability," the "costs of the action, together with a reasonable attorney's fee as determined by the court." Regulation Z separately warns that a creditor "may be subject to the forfeiture penalty under 15 U.S.C. 1666(e) for failure to comply with any of the requirements" of the billing-error section (12 C.F.R. § 1026.13(d)(3)). How those remedies apply to a particular billing-error dispute is a question for a lawyer.

The one-year deadline

Both statutes set the same limit: an action must be brought "within one year from the date of the occurrence of the violation" (15 U.S.C. §§ 1693m(g), 1640(e)). The Truth in Lending Act adds that, except as otherwise provided by state law, the limit does not stop you from raising a violation "as a matter of defense by recoupment or set-off" in a suit to collect the debt brought more than a year after the violation (§ 1640(e)).

Watch out: when a violation "occurs" can be argued, and this article did not research how courts count it. Do not wait for the bank's final answer to think about the deadline. Count from the earliest date that could apply, and talk to a lawyer well before a year has passed.

Both laws let a consumer who wins recover costs and a reasonable attorney's fee, which is worth raising when you talk to a lawyer. Our guide to getting money back after a scam lists free and low-cost legal help.

Arbitration clauses

Some bank and card agreements require disputes to go to private arbitration instead of court. Read yours for three things: whether it has an arbitration clause, whether it carves out small claims court, and whether it let you opt out. Describing its 2015 study in a 2017 rule, the CFPB said that opting out "usually requires all authorized users on an account to physically mail a signed written document to the issuer ... within a stated time limit."

The CFPB issued a rule in 2017 that would have limited class-action waivers in these clauses. Congress overturned it: "Congress disapproves the rule ... and such rule shall have no force or effect" (Pub. L. 115-74, approved November 1, 2017).

The EFTA bars any agreement that waives "any right provided by the EFTA," as the CFPB's guidance puts it, but this article did not research whether that affects where an EFTA claim must be heard. If your agreement has an arbitration clause, ask a lawyer how it applies before you file.

Watch out for recovery scams

People who were just denied a refund are prime targets for a second scam: a caller or ad offering to "recover" the money for a fee. See our warning on recovery scams, and report any such offer through our guide on where to report a scam.

Related guides

• Scams and fraud laws: the complete guide
• How to get money back after a scam: your rights by payment method
• Zelle and payment app scams
• Phishing, smishing and vishing
• Where to report a scam
• How to report identity theft
• Statute of limitations in the United States

Last updated: October 2, 2026.

Disclaimer: This article provides general legal information about US federal law as verified on October 2, 2026. It is not legal advice. For your specific situation, contact your bank or card issuer, the CFPB or your bank's regulator, or a lawyer licensed in your state.

Frequently Asked Questions

Can I appeal my bank's denial of a scam or fraud claim?

There is no formal appeal in federal law, but you can request the documents the bank relied on (12 C.F.R. § 1005.11(d)(1)), send a written challenge with new facts, and complain to the CFPB and the bank's federal regulator. A bank that fully complied has no legal duty to reconsider the same error (12 C.F.R. § 1005.11(e)).

Does my bank have to tell me why it denied my fraud claim?

Yes. For bank accounts and debit cards, the bank's report must include a written explanation and note your right to request the documents it relied on, which it must promptly provide on request (12 C.F.R. § 1005.11(d)(1)). A credit card issuer must explain its reasons and, on request, furnish documentary evidence of what you owe (12 C.F.R. § 1026.13(f)).

Can my bank deny a claim because I gave the scammer my code or login?

The CFPB says a transfer is an unauthorized EFT under Regulation E when a scammer tricks you into sharing your login, a texted code or a debit card number and then uses it to move money. Its guidance also says your negligence cannot be used to raise your liability beyond Regulation E's limits.

Will my bank refund a payment I sent to a scammer myself?

Not necessarily. Regulation E's definition of an unauthorized transfer covers transfers initiated by a person other than the consumer, so a denial of a payment you sent yourself may be lawful. Some providers reimburse certain impostor scams by voluntary policy.

Can the bank take back the provisional credit after denying my claim?

Yes, but it must tell you the date and amount and honor your checks and preauthorized payments, without overdraft charges, for five business days after that notice (12 C.F.R. § 1005.11(d)(2)).

Can my credit card company report me late after denying my dispute?

Only after the payment period or 10 days, whichever is longer. If you send further written notice within that time that the amount is still in dispute, it may not report it as delinquent unless it also reports it as disputed and tells you who received the report (12 C.F.R. § 1026.13(g)).

Will a CFPB complaint get my money back?

Not by itself. The CFPB sends complaints to the company for a response and says most companies respond within 15 days. A complaint is not a court order and does not guarantee a refund.

Can I sue my bank for denying a fraud claim?

If the bank did not follow the EFTA, you can sue for actual damages, $100 to $1,000 in statutory damages in an individual action, and costs and a reasonable attorney's fee in a successful action (15 U.S.C. § 1693m(a)). The suit must be filed within one year from the date of the occurrence of the violation (§ 1693m(g)).

When can I get treble damages from my bank?

Only if a court finds either that the bank missed the ten-day provisional recredit and did not investigate in good faith or had no reasonable basis for its denial, or that it knowingly and willfully reached a conclusion the evidence could not reasonably support (15 U.S.C. § 1693f(e)). What is tripled is actual damage.