🎯 In 30 seconds: The federal Electronic Fund Transfer Act and its Regulation E protect you when someone else moves money out of your account without your permission. They generally don’t cover a payment you sent yourself, even if a scammer lied to get it. Report unauthorized transfers fast: your share of the loss grows the longer you wait.
Unauthorized versus tricked
Zelle itself puts the line simply: if someone got into your account without you, that is usually fraud and you can typically get the money back. If you gave the “ok” to a payment, that is usually treated as a scam, and you may not get it back because you technically authorized it.
| What happened | Covered by Regulation E? | What usually happens |
|---|---|---|
| A thief logged into your app with a stolen or phished password and sent money | Yes. The CFPB’s official FAQ says a transfer made with login details obtained through fraud is an unauthorized transfer. | The bank or app must investigate; your loss is capped by the clocks below. |
| You were tricked into handing over your login or a code, and the scammer sent the money | Yes, per the same FAQ: sharing credentials because of fraud doesn’t make the transfer authorized. | Expect pushback. Cite the CFPB FAQ in writing. |
| You sent the money yourself to a scammer (fake seller, fake “bank” caller) | Generally no. You initiated it. | Depends on the app’s own policies and your bank’s goodwill. |
| You paid for goods that never arrived | No, that is a dispute with the seller. | Purchase protection may help if you paid as goods and services (see below). |
| You sent money to the wrong person by mistake | No. | Ask the recipient and your bank; recovery is not guaranteed. |
The reporting clocks
| Within 2 business days of learning your card or login was stolen | Your loss is capped at $50 or the amount taken before you told them, whichever is less. |
| After 2 business days | The cap rises to $500. |
| More than 60 days after the statement showing the transfer was sent | You can be liable for transfers after day 60 that would have been stopped had you reported. |
| Error notice deadline | The provider must get your notice within 60 days after it sent the statement where the problem first showed up. |
| If you report by phone | The provider can require written confirmation within 10 business days. |
| Investigation | 10 business days, or up to 45 days if it provisionally credits your account. New accounts, debit card purchases and foreign transfers get longer limits (20 business days and 90 days). |
A worked example
On Monday a phishing text gets your payment-app password. On Tuesday morning you see $1,800 sent to a stranger in three transfers.
- You call the app and the bank Tuesday and send a written dispute the same day. Under the general caps, the most you should bear is $50.
- If you had noticed and waited two weeks, the cap would be $500.
- If you never read the statement and the thief kept going for three months, transfers after day 60 could be all yours.
Now the other case: a “bank fraud team” talks you into sending $1,800 to “yourself” on Zelle. You pressed send, so Regulation E generally won’t help. Zelle says qualifying transactions may be eligible for reimbursement, so ask your bank in writing anyway.
App-by-app limits
- Zelle runs inside your bank’s app (the standalone Zelle app closed in 2025). Your claim goes to your bank. Zelle says to send money only to people you know and trust.
- Venmo: purchase protection covers eligible payments made with the Venmo debit card, in-app or QR checkout, or to a business profile. Personal payments not tagged as goods and services are not covered.
- PayPal: purchases sent as Goods & Services can be protected; a dispute must be opened within 180 days of the payment.
- Cash App: report unauthorized activity in the app and to the bank linked to it; check the app’s current terms for purchase coverage.
If your bank or app refuses a valid unauthorized-transfer claim, file a complaint at consumerfinance.gov/complaint. Recovery steps for every payment type are on the Money Theft & Forensics page.