Americans lost over $12.5 billion to fraud in 2024, a 25 percent increase from the year before, according to the Federal Trade Commission. More than 1.1 million identity theft reports were filed that year alone. Bank transfers and electronic payments were the highest-loss payment method — accounting for more than $2 billion in reported losses.

Most people associate identity theft with faceless hackers and online scams. But a significant and growing category of bank fraud is decidedly low-tech: criminals physically walking into bank branches with forged identity documents and walking out with someone else’s money.

In February 2026, a 59-year-old New Jersey man named Michael Scott Hillwig pleaded guilty in federal court to bank fraud, aggravated identity theft, and false use of a passport. According to the U.S. Attorney’s Office for the Northern District of Florida, Hillwig obtained victims’ names, dates of birth, Social Security numbers, and passport card numbers, then created forged U.S. passport cards bearing his own photograph but containing his victims’ personal information. He traveled to bank branches across South Carolina and Florida, presented the fake IDs and victims’ Social Security numbers to tellers, and withdrew funds directly from their accounts. He faces up to 30 years in prison.

Cases like Hillwig’s raise a question that most victims don’t think to ask until it’s too late: what happens to the money? The criminal may face prosecution, but the victim’s bank account is still empty. And in far too many cases, the bank refuses to give the money back — even when the fraud is obvious and the criminal has been caught.

Schlanger Law Group is currently litigating exactly this scenario. In Cange v. JP Morgan Chase Bank, N.A. (AAA Case No. 01-25-0002-8988), a third party entered a Chase branch in Guilford, Connecticut, presented a forged withdrawal slip, and a Chase employee appears to have electronically transferred $61,420 — the victim’s life savings — from his Chase savings account into the criminal’s recently opened Chase checking account. The victim was in Brooklyn, New York at the time and had nothing to do with the transaction. He reported the theft the same day. He filed two police reports. The Guilford Police Department, with assistance from the U.S. Secret Service, investigated and arrested the individual responsible, who was charged with Larceny in the First Degree and Identity Theft in the First Degree — both Class B felonies in Connecticut.

Chase denied the victim’s claim. Then, four days after the denial — and while the victim was still actively disputing the theft — Chase mailed the stolen funds to the criminal’s home address via check. To date, Chase has not reimbursed the victim.

How In-Branch Identity Theft Works

The basic scheme is straightforward. A criminal obtains a victim’s personal information — name, date of birth, Social Security number, and bank account details. This information may come from data breaches, stolen mail, dark web marketplaces, or social engineering tactics like imposter scams.

With that information in hand, the criminal creates a forged identity document — a fake driver’s license, passport, or passport card — that bears the criminal’s own photograph but the victim’s personal details. The criminal then walks into a bank branch, presents the forged document to a teller, and requests a withdrawal or transfer from the victim’s account.

In Hillwig’s case, this meant traveling to banks across multiple states. In Cange v. JP Morgan Chase Bank, N.A., the criminal had opened a Chase checking account with an opening balance of just $17.76 weeks before the theft, then walked into a branch and appears to have had $61,420 electronically transferred from the victim’s savings account into that newly created account. The only deposit ever made into the criminal’s account was the victim’s stolen life savings.

The victim, meanwhile, is typically somewhere else entirely. They discover the theft when they receive an account alert, check their balance, or open a statement — and find that their money is gone.

For a comprehensive guide to the identity theft recovery process, including step-by-step instructions for filing disputes and protecting your accounts, see our guide, Fighting Back: Navigating Identity Theft, Credit Reporting Errors, and Unauthorized Charges.

When Banks Refuse to Return the Money

Many victims assume that reporting the fraud and cooperating with law enforcement will be enough to get their money back. It often isn’t.

Banks frequently deny unauthorized transaction claims, even when the evidence of fraud is substantial. They may assert that their “investigation” found no error, or claim that the transaction was “authorized” — without providing any meaningful explanation of how they reached that conclusion. According to the Identity Theft Resource Center, nearly half of identity theft victims reported that their issues remained unresolved as long as 12 months after discovery.

The Cange v. JP Morgan Chase Bank, N.A. case illustrates just how badly this process can fail. The victim reported the theft the same day it occurred. He disputed repeatedly. He filed police reports in two different jurisdictions. The criminal was arrested and charged with two Class B felonies. And still, Chase denied the claim — twice — without providing a meaningful explanation or informing the victim of his right to request copies of the documents Chase relied on in reaching its conclusions.

Then Chase made things worse. While the victim was still disputing, Chase allowed the criminal to close the account that held the stolen funds and mailed a check for those funds to the criminal’s home address. The bank had been told this money was stolen. The criminal had been arrested. And Chase sent the money to him anyway.

Your Legal Rights Under the EFTA — When an Electronic Fund Transfer Is Involved

The Electronic Fund Transfer Act (EFTA) is a federal law that protects consumers from unauthorized electronic fund transfers — including debit card transactions, ACH transfers, and electronic account-to-account transfers.

A critical point that many victims — and many attorneys — overlook is that the EFTA’s protections are triggered by the presence of an electronic fund transfer. When a criminal walks into a bank branch and impersonates a victim, the EFTA applies if the bank processes the resulting transaction as an EFT. In Cange v. JP Morgan Chase Bank, N.A., for example, the criminal presented a forged withdrawal slip, but what the bank appears to have done is electronically transfer $61,420 from one Chase account to another. That electronic transfer is what brings the transaction under the EFTA’s protective framework.

This distinction matters enormously, because the EFTA provides some of the strongest consumer protections in federal law.

Liability is strictly limited. If you notify your bank within two business days of learning about an unauthorized transfer, your maximum liability is $50. If you report between two and 60 days after the bank sends your statement, liability can rise to $500 for certain transfers. Even after 60 days, your exposure is limited to transfers that occur after that window — and the bank bears the burden of proving that those transfers would not have occurred had you reported sooner. Extenuating circumstances such as extended travel or hospitalization can extend these deadlines.

The burden of proof is on the bank. Under 15 U.S.C. § 1693g(b), in any dispute over whether a transfer was authorized, the financial institution must prove that it was. The consumer does not have to prove the negative. This is a significant advantage — and one that many banks seem to ignore when denying claims.

Consumer negligence is irrelevant. Regulation E’s Official Commentary is explicit: negligence by the consumer cannot be used as the basis for imposing greater liability than the EFTA permits.

Banks must investigate — and the process has teeth. Once you report an unauthorized transfer, the bank has 10 business days to investigate and resolve your claim. If it needs more time — up to 45 days — it must provisionally credit your account while it completes the investigation, and you have full use of those funds in the meantime. If the bank concludes that no error occurred, it must provide a written explanation of its findings and notify you of your right to request copies of all documents it relied on.

Bad-faith denials carry serious consequences. Under 15 U.S.C. § 1693f(e), if a bank fails to conduct a good-faith investigation, lacks a reasonable basis for denying the claim, or knowingly and willfully concludes that the account was not in error when that conclusion could not reasonably have been drawn from the available evidence, the consumer may be entitled to treble damages — three times the amount of the proven loss. The EFTA also provides for statutory damages of $100 to $1,000, actual damages (including emotional distress), and attorney’s fees and costs.

What If There’s No Electronic Fund Transfer?

Not every instance of in-branch identity theft will involve an electronic fund transfer. If a criminal presents a forged ID and walks out of the branch with cash — or if the bank issues a paper check — there may be no EFT, and the EFTA may not apply.

That does not mean the victim has no recourse. State law provides additional protections. For example, the Uniform Commercial Code’s “properly payable” doctrine may provide an additional avenue to recovery. Under UCC § 4-401, a bank may only charge items against a customer’s account that are “properly payable.” An item containing a forged signature may not be properly payable — meaning the bank should not have honored it, and the customer should not bear the loss.

Victims may also have claims under state unfair and deceptive trade practices statutes and common law negligence. In Cange v. JP Morgan Chase Bank, N.A., Schlanger Law Group brought claims under the EFTA as well as Connecticut’s Uniform Commercial Code and unfair trade practices act.

This is one of the most important reasons to consult an attorney who practices in this area. The legal framework that applies to your case depends, among other things, on how the bank processed the transaction. A consumer protection lawyer who understands the EFTA can determine whether federal protections apply — and the EFTA’s fee-shifting provisions, statutory damages, and treble damages can make the difference between a case that is economically viable to pursue and one that is not. An attorney who does not focus on unauthorized transaction litigation may miss or mis-frame potential claims.

Additionally, some account holder agreements shorten the UCC statute of limitations, so it is important to act quickly — even if you do not think the EFTA applies.

What to Do If You’re a Victim

If you discover that someone has used a fake ID or forged document to withdraw or transfer money from your bank account, take the following steps.

Report the unauthorized transaction to your bank immediately. Call first, then follow up in writing. Under the EFTA, oral notice is sufficient to trigger the bank’s obligations, but a written record protects you. Note the date, time, and name of every person you speak with.

File an FTC Identity Theft Report at IdentityTheft.gov. This generates a formal report and a recovery plan.

File a police report. Even if your bank doesn’t ask for one, file it anyway — and provide a copy to the bank. Providing both an FTC Identity Theft Report and a police report demonstrates the seriousness of your claim and strengthens your position if the bank tries to deny it.

Place a fraud alert or credit freeze with all three credit bureaus — Equifax, Experian, and TransUnion. A credit freeze prevents the criminal from opening new accounts in your name.

Monitor your credit reports and account statements for additional unauthorized activity. Identity thieves who have your personal information may target multiple accounts.

Document everything. Keep records of every communication with your bank, including dates, names, reference numbers, and what was said. Save copies of all letters, emails, and dispute submissions. Documentation strengthens your position — but it is not a legal prerequisite. The EFTA does not require written notice, special forms, or documentation as a condition of the bank’s obligation to investigate.

Getting Legal Help

Schlanger Law Group has represented victims of unauthorized transactions and identity theft since 2007, and claims involving unauthorized bank account transfers are one of our core practice areas. We typically represent victims on a contingency fee basis and handle cases nationwide. If someone has used a fake ID or forged document to steal money from your bank account and your bank has refused to return your funds, contact us today to discuss your options.