Consumers lost $12.5 billion to fraud in 2024, a 25 percent increase from the prior year according to the Federal Trade Commission. More than 1.1 million Americans filed identity theft reports. Bank transfers and electronic payments accounted for $2.09 billion in losses alone — the highest of any payment method.
These statistics are alarming, but they can feel abstract until identity theft happens to you. That’s exactly what happened to Ginger Armbruster, the Chief Privacy Officer for the City of Seattle — someone whose job is protecting data. Over the holidays, she discovered that a thief had opened a fraudulent bank account in her name, complete with her Social Security number and home address. The statement showed nearly $5,000 in overdrafts. If it can happen to a government data privacy expert, it can happen to anyone.
Armbruster shared her experience publicly, along with advice on how to recover. Her guidance is a solid starting point. But as consumer protection attorneys who have represented identity theft victims since 2007, we know that the recovery process often requires more than what general advice covers — especially when banks refuse to cooperate. Understanding your legal rights under the Electronic Fund Transfer Act (EFTA) can make the difference between recovering your money and being left to absorb the loss.
How Identity Thieves Open Fraudulent Accounts
Identity theft is no longer limited to someone stealing your credit card and running up charges. Increasingly, thieves use stolen personal information to open entirely new accounts in victims’ names. They obtain this information through data breaches, phishing scams, imposter fraud schemes, and dark web marketplaces where stolen data is bought and sold.
In Armbruster’s case, the thief opened an account at a bank that specializes in instant credit — one she had never used. From another country, the thief then wrote fraudulent checks against the account, exploiting the processing delay between when a check is deposited and when it clears. By the time the checks bounced, the thief had already withdrawn the cash and disappeared, leaving Armbruster with a negative balance on an account she never knew existed.
This type of fraud is particularly insidious because victims often have no idea the account exists until a statement arrives in the mail, a debt collector calls, or they’re denied credit because of an account they never opened. Armbruster was fortunate that the statement came to her actual address. If the thieves had changed the mailing address before the statement went out, she might not have discovered the fraud until much later — potentially when she was served with a summons for the unpaid debt or when a default judgment was enforced against her actual bank account.
The Recovery Process: What Armbruster Did and What We Would Add
Armbruster’s public advice included several sensible steps: act fast to freeze the fraudulent account, file a complaint with the FBI through IC3.gov, freeze your credit with all three bureaus, monitor your accounts closely, and change your passwords. She also suggested being nice to customer service representatives, noting that it’s easier for them to help polite people.
That’s all good advice. But from our experience litigating these cases, we would add several critical steps that focus on documentation and legal protection.
File an FTC Identity Theft Report
Visit IdentityTheft.gov to file a report with the Federal Trade Commission. This generates an official Identity Theft Report and a personalized recovery plan. More importantly, provide a copy of this report to the financial institution — even if they don’t ask for it. This demonstrates that you’re taking the matter seriously, that you’re willing to involve federal authorities, and it creates documentation that strengthens your position if the bank later refuses to cooperate.
File a Police Report
File a report with your local police department as well. Again, provide a copy to the bank even if they don’t request it. Banks and creditors take disputes more seriously when victims have involved law enforcement. The police report also becomes part of your paper trail — evidence that you acted promptly and in good faith.
Document Everything in Writing
Being polite to customer service is good advice. But being polite doesn’t protect you. What protects you is documentation.
When you dispute unauthorized transactions or a fraudulent account, do it in writing. Send your dispute by certified mail with return receipt requested, not through the bank’s online portal. Keep copies of everything you send and receive. Note the dates, times, and names of anyone you speak with on the phone, and follow up those calls with written confirmation of what was discussed.
If your dispute is denied and you later need to pursue legal remedies, the paper trail you create now will be essential. A polite phone conversation leaves no record. A certified letter does.
Understand Where the Burden of Proof Actually Lies
Armbruster described feeling like she was in the position of having to prove the fraudulent account wasn’t hers. That’s the practical reality many victims face — banks make you feel like you’re guilty until proven innocent.
But the legal reality is different. Under the EFTA, the burden of proof is on the financial institution, not on you. Specifically, 15 U.S.C. § 1693g(b) states that in any action involving a consumer’s liability for an unauthorized electronic fund transfer, the burden is on the bank to show that the transfer was authorized. You don’t have to prove the transfer was unauthorized — they have to prove it was authorized.
This distinction matters enormously when a bank denies your claim based on a cursory investigation or simply asserts that the transactions were legitimate without providing evidence.
Your Legal Rights Under the EFTA
The Electronic Fund Transfer Act protects consumers from unauthorized electronic transactions, including debit card fraud, ATM withdrawals, ACH transfers, and — as in Armbruster’s case — fraud involving accounts opened in your name without your knowledge.
The EFTA establishes liability limits that depend on how quickly you report the problem. If you notify the bank within two business days of learning about the unauthorized transfer, your maximum liability is $50. If you report within 60 days of the bank sending your statement, your liability can rise to $500 for certain transfers. After 60 days, you may face greater exposure — but only for new unauthorized transfers that occur after that window, not for the earlier ones.
The law also imposes strict requirements on banks. Once you notify a financial institution of an error, they must investigate within 10 business days. If they need more time — up to 45 days — they must provisionally credit your account while the investigation continues. You have full use of those funds during the investigation. If the bank concludes that no error occurred, it must provide you with a written explanation and, upon request, copies of the documents it relied on.
When banks cut corners on these requirements — failing to investigate in good faith, refusing to provide provisional credit, or denying claims without a reasonable basis — they can face liability under the EFTA, including treble (triple) damages for certain violations.
When Banks Don’t Do the Right Thing
Statistics suggest that one in five identity theft victims never fully recover the money lost, and 30 percent spend over 100 hours resolving the issues. But those averages likely understate the problem for victims of significant losses.
In our experience representing victims since 2007, banks are often willing to reimburse small unauthorized charges quickly. A $50 or $200 fraudulent transaction isn’t worth the administrative cost of a full investigation, and reimbursing it maintains customer goodwill. But when losses climb into the thousands or tens of thousands of dollars, the calculus changes. Banks dig in. They conduct cursory “investigations” that amount to little more than checking a box. They issue denials.
That’s precisely when documentation matters most — and when victims need to understand that a bank’s “no” is not necessarily the final word.
What to Do If Your Bank Denies Your Claim
If your bank denies your fraud claim, you have options.
First, request the bank’s written explanation of its findings. Under the EFTA, you’re entitled to this. Review it carefully. Did the bank actually investigate, or did it simply repeat that the transactions were “verified” without explanation?
Second, request copies of the documents the bank relied on to reach its conclusion. You have a right to these as well.
Third, look for procedural failures. Did the bank complete its investigation within the required timeframe? Did it provide provisional credit if the investigation took longer than 10 business days? Did its explanation demonstrate a good faith investigation, or did it appear to be a form letter?
If the bank violated EFTA procedures, you may have a legal claim — even if you cannot definitively prove the transfer was unauthorized. The burden was on them, and if they failed to meet it, they may be liable for your losses plus statutory damages and attorney’s fees.
If Fraudulent Accounts Hit Your Credit Report
Identity theft doesn’t always end with the fraudulent transaction. If the thief opened an account in your name that went into default or collections, that account may appear on your credit report — damaging your credit score and your ability to obtain loans, housing, or even employment.
Under the Fair Credit Reporting Act (FCRA), you have the right to dispute inaccurate information with the credit bureaus and with the furnisher reporting the account. Both must investigate your dispute and correct or remove information that is inaccurate or cannot be verified.
For detailed guidance on the dispute process, see our guide on how to dispute credit report errors. For a comprehensive overview of your rights as an identity theft victim, download our free guide, Fighting Back: A Victim’s Guide to Identity Theft and Credit Report Errors.
We Can Help
Schlanger Law Group has represented victims of identity theft and unauthorized bank transactions since 2007, and these claims are among our core practice areas. We typically represent victims on a contingency fee basis — meaning you pay nothing out of pocket, and we only get paid if we recover money for you. We handle cases nationwide.
If your bank has denied your claim for unauthorized transactions, conducted a shoddy investigation, or refused to correct errors despite clear evidence of fraud, contact us today to discuss your options.
