The Distinction That Decides Everything: Unauthorized vs. Authorized-but-Scammed
If someone else accessed your account and moved money without your knowledge or permission — a stolen card, a compromised login, a fraudulent transfer you never approved — US law gives you real, enforceable protection. Regulation E, implementing the Electronic Fund Transfer Act, defines this as an "unauthorized" electronic fund transfer and caps your liability: report it within 2 business days of discovery and your maximum loss is $50; within 60 days of the statement showing it, $500; after that, you can be liable for the full amount. Your bank must investigate and, if it can't finish within 10 business days, must provisionally credit your account while it does.
If instead a scammer convinced you to authorize the transfer yourself — a romance scam, a fake tech-support call, a bogus investment, a "your bank account is compromised, move your money to this safe account" call — that payment does not meet Regulation E's definition of "unauthorized," because you initiated it. This is the single most consequential and most misunderstood fact in online scam law: authorized-but-deceived payments have historically had far weaker legal recovery protection in the US than outright unauthorized theft, regardless of how convincing the deception was.
This gap has narrowed only slightly and only for specific scenarios. After the CFPB dropped its 2024 lawsuit against the major banks behind Zelle in March 2025, a narrower 2026 industry reimbursement framework emerged that covers specific "me-to-me" bank-imposter scams (where a fraudster spoofs your bank's number and tricks you into moving money to "yourself," but actually to their account) — it does not cover every type of authorized-transfer scam, and coverage depends on your specific bank's participation and the scam's exact mechanics. verify your bank's current policy, since this is a fast-changing, non-uniform area
What You Can Realistically Recover, By Scenario
The mechanism depends entirely on whether the transfer was unauthorized or authorized-but-deceived
Unauthorized transfer (US, Reg E)
Liability capped at $50–$500 (or full reimbursement) if reported promptly — the strongest protection available.
UK authorised push payment fraud
Mandatory reimbursement up to £85,000 per claim under the PSR scheme, for qualifying UK bank transfers, minus any allowed excess.
US authorized-but-scammed transfer
No uniform legal right to reimbursement — recovery depends on your specific bank's policy, a possible bank-imposter-scam framework, a fast FBI wire freeze, or eventual court-ordered restitution if the scammer is caught and convicted.
The UK Approach: A Real Mandatory Reimbursement Scheme
The UK has taken a fundamentally different approach. Since October 7, 2024, the Payment Systems Regulator's mandatory reimbursement rules require UK payment service providers to reimburse victims of authorised push payment (APP) fraud — scams where you were deceived into authorizing a genuine bank transfer — up to £85,000 per claim, for payments made via Faster Payments or CHAPS between UK accounts. The provider must issue the reimbursement within 5 business days of the claim (or within 35 days if it needs more time to investigate), with the cost split 50/50 between the sending and receiving banks, and the sending bank allowed to charge an excess of up to £100 per claim.
This is a meaningfully stronger consumer protection than anything currently available in the US for authorized-but-scammed payments — it applies specifically to individuals, microenterprises, and charities, and specifically to UK bank-to-bank transfers, so international transfers, card payments, and crypto purchases generally fall outside its scope. verify current scope and any exclusions before assuming a specific scam is covered
Wherever you are, reporting matters for a completely separate reason: speed. The FBI's Recovery Asset Team can contact the receiving bank and request a freeze on a wire transfer before the funds move again — in 2024, this produced a 66% success rate for transfers reported promptly, but the window closes fast once money moves through multiple accounts or is converted to cryptocurrency.
What Often Doesn't Get Reimbursed
Cryptocurrency payments are generally not covered by Regulation E or the UK APP scheme — once funds move into crypto, the practical and legal recovery odds drop sharply, since crypto transfers are typically irreversible and outside traditional banking reimbursement frameworks.
Gift card payments (a hallmark of many scams specifically because they're essentially impossible to reverse) carry essentially no consumer legal protection once redeemed by the scammer.
Wire transfers to overseas accounts are harder to freeze and recover than domestic transfers, even when reported quickly, because international cooperation and banking-system differences slow down any freeze request.
What to Do Immediately After an Online Scam
Speed matters more here than in almost any other category of financial dispute
Contact your bank or payment provider immediately
For an unauthorized transfer, this starts your Regulation E protection clock. For any transfer, immediate reporting gives the bank the best chance of freezing or reversing it before funds move further.
Report to the FBI's Internet Crime Complaint Center (IC3.gov)
For wire transfers specifically, prompt reporting allows the Recovery Asset Team to contact the receiving bank and request a freeze — a meaningfully time-sensitive step.
Report to the FTC at ReportFraud.ftc.gov
This doesn't recover your money directly, but feeds federal law enforcement data used for broader investigations and can support your own case documentation.
UK: file an APP fraud claim with your bank
If the transfer was a UK bank-to-bank payment made after October 7, 2024, ask specifically about reimbursement under the PSR's mandatory scheme — the 5-business-day (or 35-day) clock starts once you report it.
File a police report
Many banks and reimbursement processes expect or require a police report as part of your claim, even if local police can't realistically recover the funds themselves.
Preserve every piece of evidence
Screenshots, messages, payment confirmations, and the scammer's account details all matter both for recovery attempts and for any later restitution if the scammer is prosecuted.
Documents to gather
- Payment confirmations, transaction IDs, and account/wallet details you sent money to
- All messages, emails, or call logs with the scammer
- Screenshots of the scam website, profile, or listing before it disappears
- Your bank's or payment provider's response to your fraud report
- The IC3 and/or FTC complaint confirmation number
Timelines and Deadlines
For unauthorized transfers and UK APP fraud, reporting speed directly determines your legal protection
These deadlines are unusually consequential compared to most consumer-rights topics — delay itself can cost you the protection, not just make it harder to prove.
| Jurisdiction | Limitation Period |
|---|---|
| US — Reg E unauthorized transfer, fastest protection | Report within 2 business days of discovery — liability capped at $50 |
| US — Reg E unauthorized transfer, standard protection | Report within 60 days of the statement — liability capped at $500 |
| US — Reg E unauthorized transfer, after 60 days | Potential unlimited liability for transfers after the 60-day window |
| UK — APP fraud reimbursement claim | Bank must reimburse within 5 business days of your claim, or 35 days if further investigation is needed |
| US — federal wire-fraud recovery request (FBI RAT) | No fixed deadline, but success rate drops sharply with any delay — report within hours/days if possible |
Realistic Outcomes and Caveats
Unauthorized-transaction claims under Regulation E, reported promptly, succeed at a high rate — this is genuinely one of the stronger consumer protections in US financial law.
Fast-reported wire transfers have a real (roughly two-thirds) chance of at least partial freeze/recovery through the FBI's Recovery Asset Team, but this drops quickly once funds have moved through multiple accounts or into cryptocurrency.
UK APP fraud claims for qualifying bank-to-bank transfers have a genuine, government-mandated reimbursement right — a meaningfully different position from most US authorized-but-scammed victims.
US victims of authorized-but-scammed transfers (romance scams, fake investment schemes, impersonation scams that aren't covered by a specific bank-imposter framework) currently have the weakest and least uniform legal protection of any scenario on this page — don't assume your bank is obligated to reimburse you, even though some banks now do so voluntarily or under narrow frameworks.
Common Pitfalls
Assuming all scam losses are "unauthorized transactions"
If you initiated the transfer yourself, even under deception, Regulation E's strongest protections generally don't apply — a fundamentally different (and currently weaker) set of rules governs authorized-but-scammed payments in the US.
Assuming the UK's reimbursement scheme applies to US transfers
The PSR's mandatory APP fraud reimbursement is specific to UK bank-to-bank transfers — it has no direct US equivalent.
Waiting to report a wire transfer
The FBI's freeze-and-recovery success rate depends heavily on speed — every day of delay reduces the odds meaningfully.
Converting to or paying in cryptocurrency
Crypto payments are essentially outside both Regulation E and the UK APP scheme, and recovery odds are far lower once funds move on-chain.
Not filing both an IC3 and an FTC report
They serve different purposes (FBI investigation and recovery vs. federal consumer-protection data) — filing only one leaves a gap in your documented record.
Organize Your Scam Report
Use the calculator to organize payment records, messages, and timeline details before reporting or filing a claim.
Organize Your Scam Report
Use the calculator to organize payment records, messages, and timeline details before reporting or filing a claim.
This stays in your private workspace until you choose a next step. It does not submit a claim on your behalf on its own.
Official and Legal References
US vs. UK Recovery Rights After an Online Scam
The US strongly protects unauthorized transactions (Regulation E caps your liability at $50–$500 if reported promptly) but has no uniform federal right to reimbursement for authorized-but-scammed payments — protection there is patchy, bank-specific, and still evolving after the CFPB's 2025 Zelle lawsuit dismissal. The UK has gone further with a mandatory, government-set reimbursement scheme (up to £85,000) specifically for authorised push payment fraud on UK bank transfers, funded jointly by sending and receiving banks. Check which country's framework — and which category of transfer — actually applies to your situation before assuming a right you may not have.
Frequently Asked Questions
What people ask right after realizing they've been scammed
I authorized the transfer myself because the scammer convinced me it was legitimate — am I protected under Regulation E?
I'm in the UK and sent money to a scammer's UK bank account — am I covered?
Is it worth reporting if I don't expect to get my money back?
Organize Your Scam Report
Use the calculator to organize payment records, messages, and timeline details before reporting or filing a claim.