How to get your money back after a payment scam

Almost every argument you are about to have with a bank turns on one definition. Regulation E, which implements the Electronic Fund Transfer Act, defines an unauthorized electronic fund transfer as one 'initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit'. That sentence is the whole fork in the road. If somebody else moved your money, you are inside the protection. If you moved it, you are outside it, however you were persuaded.

This is why so many scam victims are told their claim is denied within days. A romance scam, an impersonation scam, an invoice redirection, a fake tech support refund — in every one of them the consumer pressed send. Banks read that as an authorized transfer and close the file. The distinction is real and it is in the regulation, not invented by the bank, which is worth knowing before you spend a week arguing that it should not exist.

But a surprising number of cases are not what they first appear. If the scammer obtained your online banking credentials or your one-time code and made the transfer themselves, that is a transfer initiated by another person and it is unauthorized. If someone drained the account after taking over your phone number, same answer. If a person you once gave an access device to kept using it after you told your institution they were no longer authorized, transfers after that notice are unauthorized too. Establish which of these describes your night before you describe it to anyone.

The regulation also lists what is not unauthorized, and it is worth reading in the negative. Transfers made by a person you furnished an access device to, where you never told the institution to stop, do not count. Transfers made with fraudulent intent by you or someone acting with you do not count. Transfers initiated by the institution or its employee do not count. Nothing in that list says 'the consumer was deceived', which is precisely the gap victims fall into.

When you call, describe facts rather than conclusions. Say who logged in, from what device, at what time, what code was requested and by whom, and when you first saw the transaction. Do not volunteer the phrase 'I authorized it' as shorthand for 'I was in the room' — those are different claims and only one of them ends your case. If part of the loss was a transfer you made and part was a transfer that happened afterwards without you, say so, because the second part may be recoverable even when the first is not.

File the claim in either case. Regulation E requires the institution to investigate a notice of error, and the CFPB has acted on that duty: when it ordered the operator of Cash App to pay penalties and fix its fraud handling, it stated that the Electronic Fund Transfer Act generally requires peer-to-peer platforms to investigate disputes of unauthorized transactions and that a company cannot use fine print to escape those requirements. A refusal to investigate is a separate problem from a refusal to refund, and it is the more complainable of the two.

Recovery in the first day is a logistics problem, not a legal one. What you are trying to do is reach the institution holding the funds before the person who received them takes the money out. Every hour of delay reduces the chance that a hold can be placed on anything, which is why the sequence below is ordered by speed rather than by importance.

Call the fraud line printed on the back of your card or on your bank's website, not the branch and not a number someone gave you during the scam. Ask for four specific things and write down the answers: a hold or freeze on the destination if the transfer has not settled, a recall or reversal request to the receiving institution, a block on any further pending transfers from your account, and a case or claim reference number. Vague requests produce vague notes on a file; named requests produce actions somebody has to record.

The Office of the Comptroller of the Currency, which supervises national banks, is direct about the wire case: contact your bank and the bank that may have received your funds, and request a recall on the wire transfer that left your account. It also tells consumers to ask the bank to take steps such as closing the account or stopping any pending transfers to prevent further loss. Both halves matter — the recall chases the money that left, the account action stops the money that has not.

Contacting the receiving institution yourself is unusual advice and it is worth doing anyway. You will not be told anything about the recipient's account, and you should not expect to be. What you are doing is putting a second, independent fraud report in front of the bank that is actually holding the funds, which can trigger its own internal hold even when your bank's recall message is still queued.

Report to the FBI's Internet Crime Complaint Center at the same time rather than afterwards. IC3 describes itself as the central hub for reporting cyber-enabled crime and is operated by the FBI as the lead federal agency investigating cybercrime. Give it the exact transaction details you have — amounts, dates, account and routing numbers, wallet addresses, the phone numbers and email addresses used to contact you — because a report with transaction identifiers is actionable in a way that a narrative report is not.

Follow the phone call with something in writing the same day, even if the bank says you do not need to. Under the error resolution rules an institution may require written confirmation of an oral notice of error within ten business days, and a claim that quietly fails for want of a letter is the most avoidable loss on this page. Email to a monitored address, or the secure message center in the app, both create a timestamp.

A credit card is the strongest place to be standing, because the money has not left you yet and because federal law gives you two separate rights rather than one. The first is the billing error process. The second is the right to raise the seller's failure directly against the card issuer. They have different conditions and people routinely use the weaker one by accident.

Regulation Z defines billing errors to include an extension of credit that is not made to the consumer or to a person with actual, implied or apparent authority, transactions not properly identified on the statement, goods or services 'not accepted by the consumer or the consumer's designee, or not delivered to the consumer or the consumer's designee as agreed', failures to credit payments properly, and computational mistakes. A scam that took the form of a merchant taking payment for something that never arrived is squarely a billing error, and framing it that way is far better than framing it as having been deceived.

The notice has to be in writing and it has to reach the creditor within 60 days after the creditor transmitted the first periodic statement reflecting the alleged error. Note what the clock runs from — the date the statement was sent, not the date you noticed, and not the date of the transaction. On a charge made just after a statement closes, that gives you most of two months; on one you find while reviewing old statements, it may already be gone.

Once a valid notice arrives, the creditor must mail or deliver written acknowledgment within 30 days unless it has already resolved the dispute, and must resolve it within two complete billing cycles and in no event later than 90 days. Those are outer limits, not service standards, and issuers frequently resolve card disputes far faster through their own network processes.

While the dispute is open, the creditor may not report the amount or the account as delinquent solely because you withheld payment of the disputed amount. After the dispute is resolved, if you still owe and do not pay, the creditor may report the delinquency — but only if it also reports that the amount is in dispute and tells you which entities received that report. Keep paying the undisputed portion of the balance throughout, because withholding the whole bill converts a protected dispute into a genuine default.

Separately, liability for unauthorized use of a credit card is capped by regulation at the lesser of $50 or the value obtained by the unauthorized use before you notified the issuer, subject to conditions about the card having been accepted and the issuer having disclosed the liability limit and the means of notification. In practice most issuers charge nothing, but the statutory ceiling is why credit card fraud is a fundamentally smaller problem than debit card fraud.

The underused right is the claims and defenses provision. Where a merchant will not resolve a dispute, you may assert against the card issuer the same claims and defenses you have against the merchant — but only if you made a good faith attempt to resolve the dispute with the person honoring the card, the amount exceeds $50, and the transaction took place in the same state as your billing address or within 100 miles of it. Those amount and distance limits fall away where the merchant is the issuer, controls or is controlled by the issuer, is a franchised dealer of the issuer's products, or obtained the order through a mail solicitation the issuer participated in.

Debit runs under Regulation E rather than Regulation Z, and the practical difference is that the money has already left your account. You are asking for it back rather than declining to pay, which changes the emotional temperature of the call and nothing about the legal test. The test is still whether the transfer was unauthorized.

If it was, your liability is capped in tiers that depend entirely on how fast you spoke up. Report the loss or theft of an access device within two business days of learning about it and liability cannot exceed $50 or the actual amount of the unauthorized transfers, whichever is less. Miss that window and the ceiling rises to $500 for transfers occurring after the two days and before you notify. Fail to report an unauthorized transfer appearing on a periodic statement within 60 days of the statement being sent and you can be liable in full for transfers that occurred after that 60-day period closed. The regulation is explicit that negligence by the consumer — writing the PIN down, for instance — cannot be used to impose greater liability than these tiers allow.

The two-business-day clock starts when you learn of the loss, not when the loss happens, and it is counted as two 24-hour periods excluding the day of discovery and any non-business days — which matters if you found the problem on a Friday evening. Once you give notice of an error, the institution must investigate promptly and determine whether an error occurred within ten business days of receiving the notice — twenty business days if the account was opened within the last thirty days. It must report the result within three business days of completing the investigation and correct any error within one business day of determining that one occurred.

If it cannot finish in ten business days, it may take up to 45 calendar days, but only if it provisionally credits your account for the amount of the alleged error within that initial ten-day period and gives you full use of the funds while it works. The outer limit stretches to 90 days for three categories: point-of-sale debit card transactions, transfers not initiated within a state, and errors on accounts opened within the last thirty days. Most disputed card transactions fall into the first of those, so 90 days is the realistic worst case rather than an exotic one.

When the institution reports its findings it must tell you in writing and must note your right to request the documents it relied on. Request them if the answer is no. A denial letter that says 'our investigation determined the transaction was authorized' and nothing else is a conclusion, not evidence, and the documents behind it are sometimes just a log entry showing your device was used.

One-off ACH payments you set up yourself sit in the same difficult position as any authorized transfer. Recurring debits are different: a preauthorized electronic transfer from your account can be stopped by telling your institution at least three business days before the scheduled date, which is the route to use when a scam has left a subscription-shaped drain behind it rather than a single hit.

Wires are the hardest domestic rail to unwind and it is better to know that at the start. The OCC's guidance for consumers states plainly that wire transfers are intended to be a final and irrevocable method of payment and that the bank may not be able to reverse the wire transfer. There is no consumer chargeback for a wire and no statutory right to have one undone because you were deceived.

What exists instead is the recall request. The OCC tells consumers to immediately contact their bank and the bank that may have received the funds and to request a recall on the wire transfer that left the account. A recall is a message asking the receiving institution to return the funds voluntarily; it is not an instruction it must obey. The OCC is equally clear that a wire recall is not guaranteed to be successful in all cases.

Ask for the recall by that name, and ask when it was sent and to which institution. Ask separately for the steps the OCC describes on the account side — closing the account or stopping any pending transfers — so that a compromised account cannot be used again while the recall is in flight. If the scam involved a real estate closing, a title company or an invoice from a supplier, telephone that counterparty on a number you look up independently, because redirected-payment fraud usually means somebody else's mailbox has been compromised too.

Banks do review these claims, but case by case and against their own risk position rather than a consumer protection standard. There is no blanket promise of reimbursement in the OCC material. Where a bank ignored its own verification procedures, or processed a wire after you reported the account compromised, that is a stronger argument — and it is about the bank's conduct, not the scammer's.

The complaint routes the OCC itself points to are worth using in parallel rather than in sequence. It directs consumers to file a complaint with the OCC, with the Federal Trade Commission through its Consumer Response Center, and with the FBI's Internet Crime Complaint Center where the fraud was initiated over the internet. Filing all three costs an hour and creates three independent records with three different retention regimes.

A wire sent abroad is a different creature from a domestic Fedwire, and the next section applies to it. Do not let a bank treat an international consumer transfer as an ordinary wire with no error resolution rights attached — the remittance rules cover a great deal of what banks and money transmitters send overseas on behalf of consumers.

Consumer transfers sent to recipients in other countries sit under the remittance transfer provisions of Regulation E, which give you an error resolution right that is longer and, in one respect, more generous than anything on the domestic side. If you used a bank wire, a money transmitter or an app to send money overseas, start here rather than with the general fraud process. The rule lists what counts as an error, and the list is specific: an incorrect amount paid by the sender; a computational or bookkeeping error by the provider; the designated recipient receiving less currency than was disclosed; the failure to make funds available to the recipient by the date of availability stated in the disclosure; and a request from the sender for documentation or for information or clarification about the transfer. Each has carve-outs, notably where the disclosure was an estimate and the difference came from actual exchange rates, fees or taxes.

You have 180 days from the disclosed date of availability to notify the provider of an error. That is a far longer window than the 60 days you get on a domestic statement, and it is the reason a transfer that went wrong months ago is sometimes still live. Where you are asking about documentation the provider previously sent, the deadline is the later of 180 days after availability or 60 days after the provider sent that documentation.

Once notified, the provider must investigate promptly and determine whether an error occurred within 90 days of receiving the notice, and must report its findings within three business days of completing the investigation. Put the notice in writing and keep a copy, setting out the transfer details and exactly what went wrong, so it cannot be treated as a general enquiry.

Where an error is found, the remedy is yours to choose: a refund of the funds you provided in connection with the transfer that was not properly transmitted, or having the funds made available to the designated recipient at no additional cost to you or to them. That choice is written into the rule, so do not accept a provider deciding it for you.

There is a significant carve-out for wrong account numbers, and it is worth reading before you assume a refund is owed. The error resolution requirements do not apply where you gave an incorrect account number, if the provider can show that, used reasonably available means to verify that the identifier corresponded to the recipient institution you named, warned you before payment that giving incorrect account information could result in loss of the funds, the transfer landed in an account other than the one designated, and the provider used reasonable efforts to recover the amount. Meet all five and the provider is not required to refund or resend.

The hard truth is that 'the recipient turned out to be a scammer' does not appear anywhere in the list of errors. What the remittance rules give you is a fast, enforceable route where the transfer itself went wrong. Where the transfer worked exactly as instructed, your realistic hope is speed: contact the provider before the funds are collected, because the CFPB notes that providers will not release the money to a recipient whose identification does not match the details you supplied.

Peer-to-peer payment apps sit awkwardly between rails. They are covered by the Electronic Fund Transfer Act, and the CFPB's enforcement action against the operator of Cash App made the point that platforms must investigate disputes of unauthorized transactions and cannot use terms of service to push responsibility onto a linked bank. That order required, among other things, that unauthorized transactions be fully investigated and timely refunds provided. But the same authorized-versus-unauthorized fork applies, and an instant payment you sent yourself is the classic authorized transfer.

File with the app and with the bank or card that funded it, not one or the other. They are separate institutions with separate obligations and separate complaint records, and a claim rejected by an app is sometimes accepted by the funding bank when the underlying facts are an account takeover rather than a deception. Keep every screen: the recipient handle, the memo line, the timestamps and the in-app messages.

Gift cards are a payment method chosen by scammers precisely because there is no dispute process behind them. If you were told to buy cards and read out the numbers, do not throw anything away — keep the cards, the receipts and the activation slips, and call the number printed on the back of each card to report the fraud and ask whether the balance is still there. Then report the retailer and the brand you were told to buy.

A US Postal Service money order cannot be stopped once issued. What you can do is take your receipt to a Post Office and start a Money Order Inquiry, which USPS charges a $23.00 processing fee for and which can take up to 30 days to confirm the status and up to 60 days to investigate. Before that, check whether it has already been cashed using the Money Order Verification System on 1-866-459-7822 or the online money orders tool, using the serial number, the Post Office number and the amount from your receipt.

Cash mailed in an envelope is the one case with a genuine interception route, and it is time-limited to whatever is still in the postal system. The US Postal Inspection Service accepts reports of mail fraud, mail theft and related crimes on 1-877-876-2455 and through its online reporting form, and mail fraud sits within its jurisdiction — including sweepstakes, lottery, online auction, investment and romance scam schemes carried through the mail. Call before the package is delivered, not after.

Cryptocurrency is effectively final. There is no issuer to reverse a transaction and no error resolution rule that reaches it. The realistic steps are to report to IC3 with the wallet addresses and transaction hashes, and to notify the exchange if the destination address belongs to a hosted wallet, because an exchange can sometimes freeze an account when law enforcement asks. The CFTC publishes advisories aimed squarely at this pattern, including on relationship investment scams — the ones in which a supposed friend or new love persuades the victim into a fake trading platform — and it describes those schemes as elaborate, well organized and responsible for billions in losses.

Expect to be approached again. The CFTC publishes advisories on exactly this pattern, including one covering relationship cons, recovery scams and money laundering, and makes the point that fraud is a long story rather than a single act and that people victimized once are often targeted repeatedly. Lists of victims circulate, and a person who has already lost money and is desperate to recover it is a qualified lead.

The tell is always a fee, or a tax, or a bond, or a deposit required before the recovered money can be released. Legitimate agencies do not work that way. IC3 states directly that it does not work with any non-law-enforcement entity, such as law firms or crypto services, to recuperate lost funds, and warns that scammers are impersonating the IC3 itself. Treat any contact claiming to be a government agency recovering your money as fraudulent until you have verified it by calling a number you looked up yourself.

Be equally careful with paid 'fund recovery' or 'crypto tracing' firms found through search advertising. If you want professional help, find a licensed attorney in your state through a bar association referral service rather than through an inbound message.

If your institution denies the claim, do the two cheap things first. Ask in writing for the documents it relied on in making its determination — a right the error resolution rules give you explicitly — and escalate to the institution's executive complaints or office of the president function rather than repeating the argument with front-line staff. A meaningful share of reversals happen at that internal step, before any regulator is involved.

Then file with the CFPB. Complaints are forwarded to the company, most companies respond within 15 days, and where they cannot, they are expected to give a progress update and a final response within 60 days. You can attach supporting documents, you are notified of the company's response and have 60 days to give feedback on it, and the complaint enters the public consumer complaint database in anonymized form. The complaint line is (855) 411-2372, weekdays.

Match the regulator to the institution. The OCC handles national banks and federal savings associations through HelpWithMyBank.gov; the FDIC and the Federal Reserve, alongside state banking departments, cover state-chartered banks; the NCUA covers federal credit unions; money transmitters are licensed and supervised state by state. Your state attorney general's consumer protection division takes complaints about the business regardless of charter, and is the right route when the problem is a merchant rather than a bank.

Finally, treat civil recovery as a genuine option where you know who received the money — a fake contractor, a landlord who was never a landlord, a seller with a traceable identity. Small claims court is built for disputes of this size, does not usually require a lawyer, and a judgment is enforceable in a way a fraud report is not. That will not help against an offshore call centre, but it is frequently overlooked against a domestic counterparty who simply kept the money.