Unauthorized Card or Bank Transaction

Regulation E (12 CFR 1005.6) for debit/EFT

Liability

Report within 2 business days of learning of the loss: max $50. After 2 business days: up to $500. Unauthorized transfer on a statement: report within 60 days of the statement or you may be liable for later transfers. Extended for extenuating circumstances (travel, hospitalization).

Source →

Payment Services Regulations 2017 (SI 2017/752)

Notification deadline

Regulation 74: must notify the payment service provider without undue delay on becoming aware of the unauthorised transaction, and no later than 13 months after the debit date.

Refund timing

Regulation 76: the provider must refund the unauthorised amount and restore the account "as soon as practicable, and in any event no later than the end of the business day following the day on which it becomes aware of the unauthorised transaction", unless it has reasonable grounds to suspect fraud and notifies the relevant authority in writing.

Liability cap

Regulation 77: the payer's liability is capped at £35, except where the loss/theft was undetectable before payment (unless the payer acted fraudulently), was caused by the provider's employee/agent, or the payer acted fraudulently or with intent/gross negligence (cap does not apply in those cases).

Complaint route

Complain to the firm first — it has 15 days to respond to complaints about payment services, fraud/scams or e-money (8 weeks for most other complaints). You then have 6 months from the date of the firm's final response to refer the complaint to the Financial Ombudsman Service.

Source 1 → · Source 2 → · Source 3 → · Source 4 →

Directive (EU) 2015/2366 (PSD2)

Notification deadline

Article 71(1): must notify the payment service provider without undue delay on becoming aware of the unauthorised or incorrectly executed transaction, and no later than 13 months after the debit date.

Refund timing

Article 73(1): the payer's payment service provider must refund the amount "immediately, and in any event no later than by the end of the following business day, after noting or being notified of the transaction", except where it has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing.

Liability cap

Article 74(1): the payer may be obliged to bear losses up to a maximum of EUR 50 resulting from use of a lost/stolen payment instrument or misappropriation; does not apply where the loss was undetectable before payment (unless the payer acted fraudulently) or was caused by an employee/agent/branch of the provider. Article 74(2): where the provider does not require strong customer authentication, the payer bears no financial loss unless they acted fraudulently.

Source →