Finance account takeover response: reporting losses by rail

What to take away

Once the account is contained, the money question starts. Which rule helps you depends on how each payment left the account, not on how the attacker got in. Sort the losses by rail, then work through them one at a time.

Sort each loss by payment rail

Start by listing every payment the attacker made and naming its rail: card, ACH or wire. The rail decides which rule applies, how long you have and what the provider can still pull back, so a mixed loss needs a separate request for each payment.

Treat the table as an order of work, not a promise. Whether a payment comes back still depends on the provider, the account agreement and the facts. Knowing how a card charge settles also helps you tell a pending charge from a posted one.

Card and debit charges: report in time

Report an unauthorized electronic transfer quickly, because Regulation E ties your liability to the time you take. In the CFPB's liability tiers, you owe up to $50 if you notify within two business days of learning of the loss or theft, and up to $500 after that.

The tiers have an outer edge. If you do not report within 60 calendar days after the statement was sent, liability for unauthorized transfers made after that period is unlimited. Check the oldest statement that shows an unfamiliar entry, because those 60 days run from the date it was sent.

Once you give notice of an error, the institution has a clock too. If it cannot finish within 10 business days, it may take up to 45 days to investigate, provided it provisionally credits the amount within 10 business days of receiving the error notice. Ask for that credit by name.

For a credit card, the Regulation Z rules apply instead. A billing error notice must reach the creditor no later than 60 days after it sent the first statement showing the error. The creditor must acknowledge it within 30 days and resolve it within two complete billing cycles, and in no event later than 90 days.

Ask the issuer how it wants the dispute filed and keep proof of when you sent it. Match each disputed charge to its card transaction record first, so the request names the date, the amount and the merchant descriptor.

ACH debits: the return window is the deadline

An ACH debit moves on the Nacha return window, which is short, so this is the rail where an hour of delay costs the most. Ask your provider to request a return the day you see the entry, and ask what reason it will give.

A consumer ACH debit is also an electronic fund transfer, so the Regulation E clocks above apply to it as well. Ask the provider for the exact date the return window closes for your entry.

Ask the provider what it can see about when the destination account was linked to yours. That date separates a payment the attacker set up from one you built yourself, and it belongs in your request next to the amount and the entry date.

If the payment is still pending, say so at once. Stopping, recalling or flagging a pending payment is a different request from reversing a posted one.

Wires: ask for a recall straight away

A settled wire is usually gone unless the receiving bank agrees to return it.

Regulation E generally does not cover wires, and a bank-to-bank wire is governed by Article 4A of the Uniform Commercial Code as your state adopted it. So the useful request is a recall: ask your provider to contact the receiving bank at once and ask for the money back, then get the case number in writing.

Do not send a second payment to try to reverse the first. No legitimate support agent needs your password, your full recovery code or a one-time authentication code, and a request for one is a reason to end the contact.

Say what you authorized and what you did not

Describe each payment plainly: you authorized it, or you did not. A payment you were tricked into sending is not the same as an account takeover, and describing it that way can slow the claim.

The split matters most when an attacker talks you into approving something while already inside the account. One approved payment can sit beside several you never saw. Separate them in your request and let the provider rule on each.

If the attacker opened new accounts or took credit in your name, that is identity theft and a separate report. For the account itself, the CFPB publishes the error-resolution rules for a card or bank account. For the identity, the FTC runs IdentityTheft.gov.

One incident log, a line per payment

Build one incident log and add a line for each disputed payment. The provider handles each by rail, and each ends with its own case number, deadline and answer. Fill these in while the details are fresh:

Keep the original messages. A screenshot can lose the sender's full address and the message headers that show where it came from. Do not wipe a device until you have copied what you need.

Close the doors the attacker used

Recovering money does not stop a second attempt, so close the routes the attacker used. Ask the provider to revoke active sessions and access tokens and to remove unknown devices, recipients and linked apps. A new password on its own leaves an attacker signed in.

Replace compromised authenticators instead of stacking a new factor beside them, and verify the recovery email and phone. Sessions and connected apps can survive a password change, so ask for them to be revoked by name.

If the attacker had your inbox or mobile line, secure those first, because both can reset everything else. Ask the carrier whether the SIM or account PIN changed, and add a carrier PIN if the plan offers one.

Keep watching after the credit arrives

Keep reading statements after access looks restored. An account can look quiet while an attacker waits for a hold or a limit to clear. Look for new devices, password resets, recovery changes, small test payments, new recipients and reopened support cases.

Check every other account that shares the email, phone number, device or reused password. This is general information, not legal advice. For a disputed amount or a regulatory complaint, consult a licensed attorney or use the regulator's own filing process.

Common questions

How soon should I report a card or bank charge I did not make?

As soon as you see it. Under Regulation E, your liability turns on whether you notify within two business days of learning of the loss, and again on the 60-day mark after the statement was sent.

Can I get a wire back?

A settled wire is usually gone unless the receiving bank agrees to return it. Ask your provider to send the recall request the same day, and keep the case number it gives you.

Should I tell the provider that I was tricked into a payment?

Yes. Say plainly what you authorized and what you did not. Calling a tricked payment a takeover can slow the claim, so name each payment for what it was.

Do I report to the FTC as well?

If new accounts or credit were opened in your name, report that identity theft through IdentityTheft.gov. Reporting a lost payment to the provider is a separate step that still needs its own case number.