If someone drained your debit card or bank account, federal rules give your bank 10 business days to investigate, and if it needs longer it must put a provisional credit in your account while it finishes, with a final answer due within 45 days in most cases. Credit card disputes run on a different clock: the issuer has up to two billing cycles, and no more than 90 days, to resolve the claim. So how long does it take to get fraud money back depends on which type of account was hit, how quickly you reported, and whether the transaction crossed a border or involved a new account.
Debit Card and Bank Account Timeline
Regulation E controls the clock for debit cards, ACH transfers, and other electronic fund transfers out of a personal account. The clock starts the day the bank receives your notice.
- 10 business days to investigate and reach a determination. If the bank confirms the fraud in this window, you get a permanent credit and the matter closes.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
- Up to 45 days if the bank needs more time, but only if it provisionally credits your account for the disputed amount, plus any interest, within those first 10 business days.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
- Up to 90 days for point-of-sale debit card transactions, transfers not initiated in the United States, and transactions on new accounts opened within 30 days of the first deposit.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
New accounts get a longer initial review, too. If the disputed transfer happened within 30 days of your first deposit, the bank has 20 business days rather than 10 before it has to issue provisional credit.2eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
One trap catches people who report by phone. Your bank can require you to follow up an oral report with written confirmation within 10 business days.3Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors If the bank asks and you don’t send it, the bank is no longer required to provisionally credit your account during the investigation. The money stays gone while the case works its way through.
Miss the deadlines, and the consequences run the other way. A bank that fails to issue provisional credit on time or complete its investigation in the allowed window may have to honor the claim regardless of what its investigation ultimately finds.
Credit Card Dispute Timeline
Credit card fraud follows the Fair Credit Billing Act, which sets a longer but more forgiving schedule.
ul>
While the case is open, you don’t have to pay the disputed portion of your balance or any finance charges on it, and the issuer can’t report your account delinquent or send it to collections over the disputed amount.6GovInfo. 15 USC 1666i – Assertion by Cardholder Against Card Issuer Keep paying the undisputed portion, though, so late fees don’t stack up on charges you aren’t contesting.
If the investigation confirms fraud, the charge and any related fees come off permanently. If the issuer decides the charge was legitimate, it must explain its findings in writing before billing you for the amount again.
How Fast You Report Changes What You Get Back
Timelines describe how long the bank takes. What you actually recover depends on how fast you reported. The Electronic Fund Transfer Act ties your personal liability for unauthorized debit and account transfers directly to that delay.
- Report within 2 business days of learning about the loss or theft, and your maximum liability is $50, or the amount taken before you notified the bank, whichever is less.7Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report after 2 business days but within 60 days of the statement, and liability climbs to as much as $500.8eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report after 60 days from the statement, and you can be held responsible for every dollar taken after that 60-day mark, with no cap.7Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Someone who stops opening statements for a few months can lose everything the thief took after that 60-day window closed. The bank only has to show the later transfers could have been prevented if you had reported sooner.
Credit cards work differently. Federal law caps your liability for unauthorized credit card charges at $50, no matter when you report.9Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major issuers waive even that $50, but the statutory floor is $50 regardless of how long the fraud ran. You still need to send the written billing error notice within 60 days of the statement to preserve your full dispute rights.
Provisional Credit Isn’t Final
A provisional credit within 10 business days feels like the case is over, but it can be reversed. If the bank concludes no fraud occurred, it can pull the money back.
The bank has to notify you within three business days of finishing the investigation and provide a written explanation, along with notice that you can request the documents it relied on.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Before actually debiting the credit back, it must tell you the date and amount of the reversal, and it must honor checks and preauthorized payments for five business days after that notice without charging overdraft fees.3Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors That five-day buffer keeps the reversal from bouncing your rent or triggering a cascade of fees.
Request the investigation documents immediately. Banks sometimes deny claims based on IP logs or transaction patterns that have a reasonable explanation, and seeing what the bank relied on gives you a concrete basis for pushing back.
Where the Timelines Don’t Apply
Not every fraud loss falls under the Regulation E clock. Three gaps matter.
Authorized payment scams. If a thief broke into your account and sent money through Zelle, Venmo, or Cash App without your knowledge, that counts as an unauthorized electronic fund transfer, and the same 10-business-day and 45-day timelines apply. If you were tricked into sending the money yourself, whether through a romance scam, a fake invoice, or someone impersonating your bank, current federal law doesn’t treat the transfer as unauthorized. No federal regulation currently requires reimbursement in those cases.
Wire transfers. Once a wire settles, federal regulations don’t provide the error resolution process that debit cards and ACH transfers get. Recovery usually depends on catching the transfer before it settles, so with wires, reporting within hours matters more than reporting within days.
Business accounts. Regulation E only covers accounts held for personal, family, or household purposes.2eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) Business account fraud recovery depends on the bank’s own policies and your account agreement. The 10-business-day provisional credit, liability caps, and mandatory investigation windows don’t apply.
What Can Push the Investigation to the Full 90 Days
Some fraud claims close in a few days. Others run to the 90-day ceiling. A few variables explain most of the difference.
International transactions are the single most common cause of the longer window. When the merchant or receiving bank is overseas, these cases automatically qualify for the 90-day investigation window instead of the standard 45.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
Merchant responsiveness matters more than most people realize. The bank has to contact the merchant or its payment processor for evidence, and some reply within hours while others take weeks. You can’t force a merchant to answer faster, but you can make your own file complete: transaction screenshots, a clear timeline, and any correspondence with the merchant leave the bank less reason to pause for follow-up questions.
Claims involving multiple compromised accounts or an ongoing identity theft take longer because the bank is untangling a bigger picture. Filing a report at IdentityTheft.gov generates a formal FTC Identity Theft Report that carries more weight with financial institutions than a self-written letter, and it can move things along. A police report can do the same. No federal law requires one, but some banks ask for it on larger losses, and having it ready removes a potential delay.
If the Claim Is Denied
A denial isn’t the end. Start by asking for the documents the bank used during its investigation; under Regulation E, it must provide copies promptly upon request.1eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors If the reasoning has gaps or relies on assumptions rather than evidence, write a rebuttal and ask that the case be reopened.
If the bank still won’t move, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB forwards your complaint directly to the bank, which generally responds within 15 days and must provide a final response within 60 days.10Consumer Financial Protection Bureau. Learn How the Complaint Process Works You’ll have 60 days after the response to weigh in on whether the resolution was adequate. A regulator-forwarded complaint tends to draw a different level of attention than a customer service call.