How to Get Money Back After a Scam: Your Rights by Payment Method

Whether you can get money back after a scam depends mostly on how you paid, and on one question: did the scammer move the money, or did you send it yourself after being tricked? Federal law gives real refund rights for credit card charges and for electronic transfers out of a bank account that someone else made without your authority, with fixed reporting deadlines under Regulation E (12 C.F.R. § 1005.6 and § 1005.11) and Regulation Z (12 C.F.R. § 1026.12 and § 1026.13). Wires, gift cards, cryptocurrency and cash carry few or no legal refund rights, so speed and the payment company's own fraud process matter most.

If it just happened: contact the company you paid through (card issuer, bank, payment app, wire company, gift card issuer or crypto exchange) using the number on your card or its official app, tell them a scammer tricked you, and ask them to stop or reverse the payment. That is the first step the Federal Trade Commission lists for nearly every payment method. Then follow up in writing and report the scam.

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This article covers US federal law: the Electronic Fund Transfer Act and Regulation E, the Truth in Lending Act (including the Fair Credit Billing Act) and Regulation Z, and the FTC's Telemarketing Sales Rule, plus the published policies of some payment companies, which are policy rather than law. State laws (including state laws on cryptocurrency ATMs and state consumer-protection statutes) and card-network chargeback rules are not covered here.

Refund rights by payment method at a glance

The question that decides most cases: unauthorized, or tricked into paying?

Bank and app refund rights turn on the word "unauthorized." Regulation E defines it this way:

"'Unauthorized electronic fund transfer' means an electronic fund transfer from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit." (12 C.F.R. § 1005.2(m))

The definition excludes transfers by someone you gave your card or code to, unless you told the bank that person's authority had ended. The official commentary narrows that exclusion for scams: "An unauthorized EFT includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery." (Supplement I to Part 1005, comment 2(m)-3.)

When a scammer got into your account

The Consumer Financial Protection Bureau (CFPB) has applied that rule to common scams. Its Regulation E guidance says that when "a consumer is fraudulently induced into sharing account access information with a third party, and a third party uses that information to make an EFT from the consumer's account, the transfer is an unauthorized EFT under Regulation E." Its examples include a caller "pretending to be a representative from the consumer's financial institution" who tricks the consumer into providing "their account login information, texted account confirmation code, debit card number," and a scammer who uses phishing to "observe the consumer entering account login information."

The same guidance says your bank cannot hold your carelessness against you. Regulation E's commentary "expressly states that negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E." So sharing a code with someone who sounded like your bank does not by itself cost you these protections.

When you sent the money yourself

If you personally sent the payment (for example, you wired money to a fake "investment adviser" or paid a fake seller through your bank app), the transfer was initiated by you, not by "a person other than the consumer." As written, the definition generally does not reach that payment, and banks and apps often treat it as authorized. The CFPB guidance we reviewed does not address this situation.

That does not mean the answer is always no. Some companies go further than the law by policy. Zelle's network operator, for example, says it "requires reimbursement for customers for certain qualifying imposter scams where the customer authorized the transaction," and describes that as going "above and beyond what is required by law." The Consumer Federation of America, a consumer advocacy group, told a House subcommittee in March 2026 that for authorized transfers, "To the extent scam victims receive relief, it is due to voluntary responses by providers, and not by the force of law." That is an advocate's statement, not a ruling.

Practical point: describe exactly what happened when you call. If the scammer obtained your login, code or card number and moved the money, say so; that is the situation the CFPB guidance treats as unauthorized.

Why speed matters

The FTC puts it simply: "If you’ve paid a scammer, the sooner you act, the better." The FBI's Internet Crime Complaint Center (IC3) runs a Recovery Asset Team that, according to the FBI's 2025 IC3 report, "streamlines communications with financial institutions and FBI field offices to assist in the freezing of funds for victims of fraudulent domestic and international transactions" through its Financial Fraud Kill Chain.

In 2025, the team worked 3,900 incidents involving $1,163,919,846 in attempted theft and froze $679,013,183, which the report lists as a 58% success rate. Those figures cover only the incidents the FBI acted on; they are not the odds for every scam victim.

The report's advice: "If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents." It adds: "Regardless of the amount lost, file a complaint at www.ic3.gov. Be sure to include the full transaction details in your report."

Credit card payments

Governing law: the Truth in Lending Act and Regulation Z, including the billing-error rules from the Fair Credit Billing Act. Credit cards give the most protection of any payment method.

If someone used your card without authority

Your liability for unauthorized use "shall not exceed the lesser of $50 or the amount of money, property, labor, or services obtained by the unauthorized use before notification to the card issuer" (12 C.F.R. § 1026.12(b)(1)(ii)). Unauthorized use includes "a transaction initiated by a person who has obtained the credit card from the consumer, or otherwise initiated the transaction, through fraud or robbery" (Regulation Z commentary, comment 12(b)(1)(ii)-4). You may report unauthorized use "in person, by telephone, or in writing" (12 C.F.R. § 1026.12(b)(3)).

If you paid a scammer for something that never came

Regulation Z treats as a billing error a charge "for property or services not accepted by the consumer or the consumer's designee, or not delivered to the consumer or the consumer's designee as agreed" (12 C.F.R. § 1026.13(a)(3)). If you paid a fake seller who never delivered, you may have dispute rights under this rule. A charge you knowingly made for a service that turned out to be fraudulent sits between the categories, so present the facts and let the issuer classify them.

A separate rule lets a cardholder raise claims and defenses (other than tort claims) from a purchase against the card issuer, but only up to the amount still unpaid on that purchase when you first notify, only after a good-faith attempt to resolve the dispute with the seller, and (with exceptions) only when the charge exceeds $50 and the purchase occurred in your state or within 100 miles of your current designated address (12 C.F.R. § 1026.12(c); 15 U.S.C. § 1666i).

Deadline and what to put in writing

1. Call the issuer now using the number on the back of the card, and ask for a new card number if the old one was exposed.
2. Send a written billing-error notice so it is received at the billing-error address the issuer discloses "no later than 60 days after the creditor transmitted the first periodic statement that reflects the alleged billing error" (12 C.F.R. § 1026.13(b)(1)). A phone call alone does not start the billing-error protections.
3. Include your name and account number, and, to the extent possible, why you believe there is an error and "the type, date, and amount of the error" (12 C.F.R. § 1026.13(b)(2)-(3)).

The issuer must acknowledge your notice in writing within 30 days and resolve it "within 2 complete billing cycles (but in no event later than 90 days)" (12 C.F.R. § 1026.13(c)). While it investigates, you "need not pay (and the creditor may not try to collect)" the disputed amount, and the issuer may not report you as delinquent for not paying it (12 C.F.R. § 1026.13(d)).

Debit card, bank account and ACH transfers

Governing law: the Electronic Fund Transfer Act (EFTA) and Regulation E. These rules protect you against unauthorized transfers, as explained above. In a lawsuit over your liability for an unauthorized transfer, the EFTA puts "the burden of proof ... upon the financial institution to show that the electronic fund transfer was authorized" (15 U.S.C. § 1693g(b)).

The deadlines that set your liability

• Two business days. If you notify the bank "within two business days after learning of the loss or theft of the access device" (a card, code or other means of access), your liability "shall not exceed the lesser of $50 or the amount of unauthorized transfers that occur before notice" (12 C.F.R. § 1005.6(b)(1)). Miss that window and the cap rises to $500, and transfers after the two days count against you only if the bank shows timely notice would have prevented them (§ 1005.6(b)(2)).
• 60 days after the statement. You "must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution's transmittal of the statement to avoid liability for subsequent transfers" (12 C.F.R. § 1005.6(b)(3)). For an unauthorized debit made without your card or code, the commentary's example is that if you report it within the 60 days, "the consumer has no liability" (comment 6(b)(3)-2).
• After 60 days. Your exposure is limited to transfers that occur after the 60 days and before you give notice, and only those the bank "establishes would not have occurred had the consumer notified the institution within the 60-day period" (§ 1005.6(b)(3)).
• Extenuating circumstances. If your delay was due to extenuating circumstances, the bank "shall extend the times specified above to a reasonable period" (§ 1005.6(b)(4)). The commentary names "extended travel or hospitalization" as examples.

Someone else can report for you. The commentary says notice "by a person acting on the consumer's behalf is considered valid," for example when the account holder is hospitalized, though the bank may ask for documentation of that person's authority (comment 6(b)(5)-2).

What the bank must do after you report

The CFPB's guidance adds that a bank "must begin its investigation promptly upon receipt of an oral or written notice of error" and cannot require you to contact the merchant first. Network rules saying a payment is "final and irrevocable" do "not reduce consumer protections against liability for unauthorized EFTs."

What to put in writing: your name and account number, why you believe there is an error, and, as far as possible, the type, date and amount (§ 1005.11(b)(1)). Say plainly whether someone obtained your login, code or card number, and when you learned of it.

Honest odds: good for transfers a scammer made. If you made a debit card purchase from a fake seller, note that Regulation E's list of "errors" in § 1005.11(a)(1) has no category for goods that were never delivered, unlike the credit card rule, so ask the bank whether it will dispute the charge.

Zelle and payment apps

Zelle moves money between bank accounts, so your bank is the institution with Regulation E duties. Asked whether your bank is "a financial institution with full error resolution obligations" when a fraudster initiates a transfer from your account through a payment service, the CFPB's answer is "Yes." Zelle's own pages say that when someone "gained access to your bank account and made an unauthorized Zelle® payment," those transactions "typically qualify for reimbursement," while for a payment you knowingly sent, "Certain impostor scams qualify for reimbursement." Zelle also says it "does not offer a protection program for any authorized payments," such as an item you never received.

Payment apps that hold your money have their own duties. Announcing a January 2025 order against Cash App's operator, the CFPB said "The Electronic Fund Transfer Act generally requires that peer-to-peer platforms, including Cash App, investigate disputes of unauthorized transactions." Purchase protection is a separate matter of company policy: as of October 2026, PayPal's buyer protection excludes "payments sent using PayPal's friends and family functionality" and requires an item-not-received dispute "within 180 days of the date you sent the payment." Venmo limits its purchase protection to certain payments to business profiles or payments marked for goods and services.

Cash App's terms warn that "scams may result in the loss of your funds with no recourse." For the full breakdown of each company's policy, enforcement history and the steps to take, see our guide to Zelle and payment app scams.

Wire transfers

A wire sent through your bank

Regulation E excludes "Any transfer of funds through Fedwire or through a similar wire transfer system that is used primarily for transfers between financial institutions or between businesses" (12 C.F.R. § 1005.3(c)(3)). Whether a particular consumer wire falls in that exclusion is a legal question we did not resolve, so do not assume either way; assume instead that the money is moving fast.

If the wire went to someone in another country, your bank's transfer may be a remittance transfer with the 30-minute cancellation and 180-day error rights described below, unless the bank sends 500 or fewer such transfers a year (12 C.F.R. § 1005.30).

Call your bank immediately and ask it to recall the wire, as the FBI advises. The FTC's advice for a bank wire is to report the fraudulent transfer and "Ask if they can reverse the wire transfer." Then file with IC3 at ic3.gov with the full transaction details.

A money transfer company or an international transfer

When you send money to someone "at a location in a foreign country" through a remittance provider, Regulation E's remittance rules apply (12 C.F.R. § 1005.30). Two rights matter:

• 30-minute cancellation. The provider must cancel and refund if your request is received "no later than 30 minutes after the sender makes payment" and the funds "have not been picked up by the designated recipient or deposited into an account of the designated recipient" (12 C.F.R. § 1005.34(a)). The refund, including fees, is due "within three business days."
• Error notice. You may report an error within "180 days after the disclosed date of availability," and the provider must decide "within 90 days" (12 C.F.R. § 1005.33(b)-(c)). The listed errors cover things like a wrong amount or late delivery; being deceived into sending the money is not among them.

The FTC warns that "Wiring money with services like MoneyGram, Ria, and Western Union is like sending cash." Its advice is to contact the company right away, "Tell them it was a fraudulent transfer," and ask for a reversal and refund.

Gift cards

No federal rule we identified requires an issuer to refund a gift card balance a scammer took. The FTC says "Only scammers will tell you to buy a gift card, like a Google Play or Apple Card, and give them the numbers off the back of the card."

What to do, per the FTC: "Contact the gift card issuer immediately. Use the number on the back of the card. Tell them that a scammer tricked you into giving them the card number and PIN. Ask them to refund your money." Keep the card and the receipt. The FTC adds that "Some companies are helping stop gift card scams and might give your money back," and gives Google as an example: "If the money is still on the card, Google can put a freeze on it." That is issuer policy, not a legal right.

A common claim online is that federal law bans gift card payments. The Telemarketing Sales Rule bars sellers and telemarketers from accepting "a cash-to-cash money transfer or cash reload mechanism" as payment for anything sold through telemarketing (16 C.F.R. § 310.4(a)(10)), but that rule does not name retail gift cards.

Cryptocurrency

The FTC is direct: "Cryptocurrency payments typically are not reversible. Once you pay with cryptocurrency, you can usually only get your money back if the person you paid sends it back." It also says crypto payments "don't have the same legal protections as credit and debit cards do," though "some states have passed laws that might help you."

What to do: "Contact the cryptocurrency exchange or ATM operator immediately. Tell them it was a fraudulent transaction. Ask them to reverse the transaction and refund your money." Then report to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov, and keep the wallet addresses and transaction IDs.

Crypto victims are a favorite target of fake "recovery" firms. See the warning below before you answer anyone who offers to trace your coins.

Checks and fake checks

If a stranger sent you a check and asked you to send part of it back, stop before you send anything. The FTC explains: "By law, banks have to make deposited funds available quickly. Even if you see the funds in your account, that doesn't mean it's a good check. Fake checks can take weeks to be discovered and untangled. By that time, the scammer has any money you sent, and you're stuck paying the money back to the bank."

If you already sent money from a fake check, the recovery route is the method you used to send it (a wire, gift card, app or crypto), covered above. The FTC warns that once you send a scammer gift card numbers, cryptocurrency or a wire transfer, "it's like you've given them cash. It's almost impossible to get it back."

If you wrote a check to a scammer, call your bank right away and ask whether payment can still be stopped. This guide does not cover stop-payment rules.

Cash or money orders sent by mail or courier

For cash sent through the U.S. mail, the FTC says to "Contact the U.S. Postal Inspection Service at 1-877-876-2455 immediately. For a fee, they can intercept the package. This lets you redirect a domestic shipment that hasn't been delivered." For FedEx, UPS or another carrier, contact them "as soon as possible."

Once a cash package is delivered, we found no legal mechanism to get the money back. For a money order, keep your receipt and contact the seller of the money order right away to ask whether it has been cashed; we did not verify a federal refund process for money orders.

Build your paper trail

Whatever you paid with, write down the date, amount, transaction or confirmation number, the account the money went to, and every phone number, email, website and screen name the scammer used. Save screenshots and texts.

The FBI's IC3 does not take attachments; its FAQ tells complainants to "keep all original documents in a secure location" in case an investigating agency asks for them. When you call your bank or card issuer, note the date, time and name of each person you speak to, then confirm the call in writing.

If the bank, card issuer or app says no

1. Ask for the explanation and the documents. If a bank finds no error, its report "shall include a written explanation of the institution's findings and shall note the consumer's right to request the documents that the institution relied on" (12 C.F.R. § 1005.11(d)(1)). A card issuer that denies a billing error must explain its reasons and provide documentary evidence on request (12 C.F.R. § 1026.13(f)).
2. Watch for a reversed provisional credit. If the bank takes back a provisional credit, it must tell you the date and amount and honor your checks and preauthorized payments for five business days after that notice (12 C.F.R. § 1005.11(d)(2)).
3. File a CFPB complaint. The CFPB takes complaints about financial products and services at consumerfinance.gov/complaint or (855) 411-2372. It says "Most companies respond within 15 days," and that it will send your complaint to another government agency if that agency would be better able to assist. Include everything at once, because "you generally can't submit a second complaint about the same problem."
4. Contact your state attorney general. The National Association of Attorneys General keeps a directory of every state attorney general.
5. Know the deadline to sue. A company that fails to follow the EFTA is liable for actual damages, statutory damages of "not less than $100 nor greater than $1,000" in an individual action, plus, "in the case of any successful action to enforce the foregoing liability, the costs of the action, together with a reasonable attorney's fee" (15 U.S.C. § 1693m(a)). That excludes "an error resolved in accordance with section 1693f," and the suit must be filed "within one year from the date of the occurrence of the violation" (§ 1693m(g)). The Truth in Lending Act similarly makes a creditor that breaks the billing-error rules liable for actual damages, statutory damages, and, in a successful action, costs and a reasonable attorney's fee, with the same one-year limit (15 U.S.C. § 1640(a), (e)).

These are claims against a bank or card issuer that did not follow the rules. They are not a general right to be repaid for every scam.

Watch out: recovery scams

People who already lost money get targeted again. The FTC says scammers "buy lists of people who've paid scammers," then contact victims claiming to be "with a government agency, a consumer advocacy group, a law firm, or some other organization" and ask for a "retainer fee," "processing fee" or "tax." Its rule of thumb: "Did someone contact you and ask for an upfront fee? That's a scammer." It adds that government agencies and legitimate organizations "will not guarantee that you'll get your money back."

The FBI has warned repeatedly about fake law firms targeting cryptocurrency scam victims. Its August 2025 alert says "There are no law firms which are officially authorized partners of US Government agencies," and "The US Government does not request payment for law enforcement services provided." IC3 itself "does not work with any non-law enforcement entity, such as law firms or crypto services, to recuperate lost funds."

Under the Telemarketing Sales Rule, a telemarketer may not request or receive a fee for recovering money you lost "until seven (7) business days after such money or other item is delivered to that person," though the rule "shall not apply to goods or services provided to a person by a licensed attorney" (16 C.F.R. § 310.4(a)(3)). The rule covers telemarketing campaigns that involve more than one interstate telephone call (16 C.F.R. § 310.2).

If you lost money to a recovery scam, report it to the FTC at ReportFraud.ftc.gov and to your state attorney general.

When a lawyer helps

A lawyer is most useful when a bank, card issuer or app did not follow the federal rules above, because the EFTA and the Truth in Lending Act let a court award costs and a reasonable attorney's fee to a consumer who wins. The one-year filing limits make early advice worthwhile.

Suing the scammer is a different matter: it requires a defendant you can identify and reach. If prosecutors charge the scammer in federal court, the Mandatory Victims Restitution Act requires a sentencing court to order restitution for offenses "committed by fraud or deceit" with identifiable victims (18 U.S.C. § 3663A), but that depends on a conviction, and an order is not the same as payment. If your loss involved a brokerage firm or broker, FINRA arbitration may be available against FINRA members, generally within six years of the event (FINRA Rules 12200 and 12206); it is not available against a website or person that is not a FINRA member firm or associated person.

For free or low-cost help, the Legal Services Corporation lists legal aid organizations for low-income Americans, and the American Bar Association points to public-service lawyer referral services. The FBI's advice: "Be cautious of law firms contacting you unexpectedly, especially if you have not reported the crime to any law enforcement or civil protection agencies." Our scams and fraud law guide covers suing, restitution and lawyer options in more depth.

Report it, even if the money is gone

• FTC: ReportFraud.ftc.gov. The FTC uses reports to "build cases against scammers" and "spot trends." Spanish speakers can use ReporteFraude.ftc.gov and the FTC's Spanish guide, Qué hacer si lo estafaron.
• FBI: ic3.gov for any internet-enabled scam, with full transaction details.
• Age 60 or older: the Justice Department's National Elder Fraud Hotline, 833-372-8311, Monday to Friday, 10 a.m. to 6 p.m. Eastern, with English and Spanish available.
• Identity information given away: if you gave a scammer your Social Security number and it was used, the FTC directs you to IdentityTheft.gov. See how to report identity theft and credit freeze vs. fraud alert.

Our guide on where to report a scam explains what each agency does with a report.

Related guides

• Scams and fraud laws: the complete guide
• Zelle and payment app scams: can you get your money back?
• Where to report a scam
• Phishing, smishing and vishing
• Tech support and fake invoice scams
• Identity theft laws

Last updated: October 2, 2026.

Disclaimer: This article provides general legal information about US federal law as verified on October 2, 2026. It is not legal advice, and company policies described here can change at any time. For your specific situation, contact your card issuer, bank or payment company, the agency named above, or a lawyer licensed in your state.

Frequently Asked Questions

Can I get my money back if I was scammed?

It depends on how you paid. Credit card charges and bank or debit transfers a scammer made without your authority have federal protections under Regulation Z and Regulation E; wires, gift cards, cryptocurrency and cash usually depend on how fast you act and the company's own policy.

Will my bank refund me if a scammer tricked me into giving my login or code?

The CFPB says that when a scammer tricks you into sharing account login information, a texted code or a debit card number and then moves money, the transfer is an unauthorized EFT under Regulation E. Report it to your bank as soon as you learn of it; your liability depends on how quickly you report (12 C.F.R. § 1005.6(b)), and the error notice must arrive within 60 days after the statement showing it (12 C.F.R. § 1005.11(b)).

Will my bank refund a payment I sent to a scammer myself?

Not necessarily. Regulation E's definition of an unauthorized transfer covers transfers initiated by a person other than the consumer, so banks often treat your own payment as authorized. Some providers reimburse certain impostor scams by policy, so ask anyway.

How long do I have to dispute a credit card charge from a scam?

A written billing-error notice must be received by the issuer within 60 days after it sent the first statement showing the charge (12 C.F.R. § 1026.13(b)). Unauthorized-use liability is capped at $50 (12 C.F.R. § 1026.12(b)).

How long do I have to report an unauthorized debit card or bank transfer?

Within two business days after learning your card or code was lost or stolen to keep your liability at $50 or less, and within 60 days after the statement showing the transfer to avoid liability for later transfers (12 C.F.R. § 1005.6(b)).

Does the bank have to give me provisional credit while it investigates?

If the bank takes more than 10 business days to investigate an electronic transfer error, it must provisionally credit your account within 10 business days to use the longer period of up to 45 days (12 C.F.R. § 1005.11(c)(2)).

Can a wire transfer be reversed after a scam?

Sometimes, if you act fast. Ask your bank to recall the wire and file at ic3.gov. For an international transfer through a remittance provider, you can cancel for a full refund within 30 minutes if the money has not been picked up or deposited (12 C.F.R. § 1005.34).

Can I get my money back from a gift card scam?

Possibly, if you act before the balance is spent. The FTC says to call the issuer using the number on the back of the card, say a scammer tricked you, ask for a refund, and keep the card and receipt. Refunds are issuer policy, not a legal right.

Can you get money back from a crypto scam?

Rarely. The FTC says crypto payments typically are not reversible and you can usually get money back only if the recipient sends it back. Contact the exchange or crypto ATM operator immediately and report to the FTC and ic3.gov.

Is someone offering to recover my scam losses for a fee legitimate?

The FTC says anyone who contacts you and asks for an upfront fee to recover lost money is a scammer. The Telemarketing Sales Rule bars telemarketers from charging for recovery until seven business days after the money is delivered, except for licensed attorneys (16 C.F.R. § 310.4(a)(3)).