Frequently Asked Questions About Payment Platform Fraud

The Electronic Fund Transfer Act (EFTA) and its implementing regulation, Regulation E, cover electronic transfers from consumer accounts. This includes transfers made through popular payment platforms such as:

• Zelle
• Venmo
• PayPal (when linked to a bank account or holding a balance)
• Cash App
• Apple Pay
• Google Pay

These platforms facilitate electronic fund transfers—whether through direct bank account access, debit card transactions, or transfers from stored balances—and are subject to EFTA protections.

The EFTA defines “financial institution” broadly to include not just banks and credit unions, but also “any other person who, directly or indirectly, holds an account belonging to a consumer.” This means that both your bank and the payment platform itself may have obligations under the law.

If money is stolen from your account through an unauthorized transfer, the EFTA provides significant protections. Under the law, your liability for unauthorized electronic fund transfers is capped—and in many cases, you may owe nothing at all.

The EFTA’s liability limits depend on how quickly you report the problem:

Report within 2 business days of learning of the theft: Your maximum liability is $50 (or the amount of the unauthorized transfers, if less).

Report after 2 business days but within 60 days of your statement: Your maximum liability is $500.

Report after 60 days from your statement: You may be liable for the full amount of unauthorized transfers that occur after the 60-day period, but only if the bank can prove the losses would not have occurred had you reported sooner.

These liability caps apply regardless of whether you were negligent. Under Regulation E, consumer negligence—such as writing your PIN on your debit card—cannot be used to impose greater liability than the statute allows.

An unauthorized electronic fund transfer is one that is initiated by a person other than the consumer, without actual authority, and from which the consumer receives no benefit.

Importantly, under Regulation E’s Official Interpretations, a transfer is considered unauthorized when someone obtains your access device (such as your login credentials, debit card number, or PIN) through fraud or robbery. This means that if a scammer tricks you into revealing your login information or account access codes, transfers they initiate using that information are unauthorized—even though you provided the fraudster with your credentials.

Schlanger Law Group served as counsel to the plaintiff in Green v. Capital One, N.A., a landmark case in which the court held that “under the Official Interpretation, access obtained by fraud was never truly ‘authorized'” under the EFTA. This principle is critical for victims of imposter scams and other fraud schemes.

When you report an unauthorized transfer or other error, the EFTA requires your financial institution to:

Investigate promptly: The bank must investigate your claim and report the results within 10 business days.

Provide provisional credit: If the bank needs more time to investigate (up to 45 days), it must provisionally credit your account within 10 business days so you have use of the funds while the investigation continues.

Explain any denial: If the bank determines that “no error occurred,” it must provide you with a written explanation of its findings within 3 business days of completing its investigation.

Provide supporting documents: Upon your request, the bank must promptly provide copies of the documents it relied on in reaching its conclusion.

These procedural requirements apply regardless of the dollar amount involved. A bank that fails to follow them may be liable under the EFTA even if the underlying transfer turns out to have been authorized.

Banks deny fraud claims for many reasons—sometimes legitimate, sometimes not. Common reasons for denials include:

• The bank believes you authorized the transfer
• The bank claims you benefited from the transaction
• The bank asserts you failed to report timely

The bank’s investigation concluded (rightly or wrongly) that no error occurred

If your bank denies your claim, you should:

Request the denial in writing along with an explanation of the bank’s reasoning.

Ask for the documents the bank relied on in its investigation. You have a right to these under the EFTA.

Review the denial carefully to understand the bank’s stated basis.

Consider whether the bank followed proper procedures. Did they investigate within 10 business days or provide provisional credit? Did they give you a written explanation?

If you believe the denial is wrong, or if the bank failed to follow EFTA procedures, you may have a legal claim.

The EFTA provides for several categories of damages:

Actual damages: Compensation for your actual losses, including the stolen funds that weren’t returned, any overdraft or other fees incurred, and other consequential harms.

Statutory damages: In individual cases, you may recover between $100 and $1,000 in addition to actual monetary harm.

Treble damages: For certain violations—including failure to provisionally credit your account, failure to conduct a good faith investigation, or concluding without reasonable basis that no error occurred—the EFTA provides for damages of up to three times your actual damages.

Attorney’s fees and costs: A prevailing consumer is entitled to recover reasonable attorney’s fees and costs. This fee-shifting provision makes it possible to bring EFTA claims even when the stolen amount is relatively modest.

You should report unauthorized transfers as soon as you discover them. While the EFTA provides some flexibility, faster reporting generally means better protection:

• Within 2 business days: Maximum liability of $50
• Within 60 days of your statement: Maximum liability of $500
• After 60 days: Potentially unlimited liability for transfers occurring after that period

The 60-day clock typically starts when your financial institution sends or makes available a statement showing the unauthorized transfer.

Beyond the liability caps, prompt reporting also helps preserve evidence and gives the bank the best chance of recovering funds before they’re moved out of reach.

If you discover unauthorized transfers from your Zelle, Venmo, PayPal, Cash App, or similar account:

Report immediately. Contact both your bank and the payment platform as soon as possible. Follow up any phone report with written notice.

Document everything. Keep records of all communications, including dates, times, and the names of representatives you speak with. Save screenshots of unauthorized transactions.

File a written dispute. Submit a written dispute that identifies your name and account, describes the error, states the amount, and explains why you believe an error occurred. Send it by certified mail with return receipt requested.

Request investigation documents. If your claim is denied, ask for copies of the documents the bank relied on.

File a police report. This creates an official record and may be helpful for your bank’s investigation or any future legal action.

Monitor your accounts. Watch for additional unauthorized activity and report any new issues immediately.

If you’ve reported unauthorized transfers to your bank and they haven’t refunded your money, we can help.

Schlanger Law Group is a national leader in EFTA litigation. We represented the plaintiff in Green v. Capital One, N.A., a landmark decision establishing that access obtained through fraud is not “authorized” under the EFTA. We regularly handle payment platform fraud cases in New York, New Jersey, and nationwide.

We can evaluate whether you have a viable EFTA claim and represent you in litigation against banks and payment platforms that failed to honor their obligations under the law.

If you are the victim of payment app fraud and your bank won’t refund your money, contact us for a free consultation.