A reader in New York wrote to us: someone changed the phone number linked to her bank account, she was locked out, and $180,000 was taken out by check. She asked the bank to stop the check before it cleared, but the money was paid anyway. Her complaint was rejected because the bank suspected she had leaked her own information. Is the bank off the hook? Usually not automatically. The answer depends first on how the money left the account.
Why does the payment method matter so much?
Three different bodies of law apply:
- Checks — Articles 3 and 4 of the Uniform Commercial Code, as adopted in each state (in New York, N.Y. U.C.C. §§3-403, 3-406, 4-401, 4-406).
- Consumer electronic transfers — online or app transfers, debit card and ATM withdrawals from a personal account — the Electronic Fund Transfer Act and Regulation E (12 C.F.R. part 1005).
- Wire transfers — Article 4A of the UCC, which expressly does not cover transfers governed by the EFTA.
Many articles online apply the wire-transfer rules to every fraud. That is a mistake, and it often favors the bank.
The money left by check. What is the rule?
A bank may charge your account only for items that are “properly payable” — that you authorized (N.Y. U.C.C. §4-401). A check with a forged or unauthorized signature is not properly payable, so as a starting point the bank bears the loss and must recredit the account.
The bank can shift some or all of the loss to you in two main ways:
- Your negligence substantially contributed to the forgery (§3-406). If the bank also failed to use ordinary care — for example, paying an unusually large check without verification after the contact details were suddenly changed — the loss is split according to each side’s fault.
- You did not review your statements and report the problem with reasonable promptness (§4-406). In any case, a claim for an unauthorized signature or alteration must be raised within one year after the statement or item is made available to you.
So “you may have leaked your information” is not the end of the analysis. The question is whether your conduct substantially contributed, and whether the bank exercised ordinary care when it paid.
What if the money left by online transfer from a personal account?
Regulation E limits a consumer’s liability for unauthorized electronic transfers. If you notify the bank within two business days after learning of the loss or theft of your access device, liability is capped at $50. After that, up to $500. And for transfers shown on a statement, you must report within 60 days of the statement being sent, or you may bear later losses (12 C.F.R. §1005.6). The bank must investigate and usually provisionally recredit within set time limits (12 C.F.R. §1005.11). Note that transfers you authorized yourself because a scammer tricked you are generally treated as authorized.
And if it was a wire transfer?
Under Article 4A, if you (or your authorized representative) actually ordered the wire, it is authorized, even if you were deceived. If someone else sent it, the bank can still hold you to it only if it used a commercially reasonable security procedure that you agreed to and followed it in good faith (U.C.C. §4A-202). In Patco Construction Co. v. People’s United Bank, 684 F.3d 197 (1st Cir. 2012), the bank lost because its procedures were not commercially reasonable. You must object within one year of notice of the transfer (U.C.C. §4A-505).
What should I do right now?
- Notify the bank in writing, today, and keep a copy. Ask for a fraud claim number.
- Ask for copies of the checks (front and back), the deposit information, and the record of changes to your phone number, email and address.
- Sign the bank’s forgery affidavit if it is a check case, and file a police report.
- Review every statement since the change and report each unauthorized item.
- If the bank refuses, file a complaint with its regulator. For a national bank, that is the OCC; you can also file with the CFPB and, in New York, the Department of Financial Services.
- Check the account agreement for arbitration clauses and shortened deadlines before the time to sue runs.
How can I protect myself going forward?
- Use an authenticator app instead of text-message codes where possible, and add a carrier PIN to stop SIM swaps.
- Set alerts for changes to contact details and for any check or transfer above a modest amount.
- Ask the bank about positive pay for checks and daily limits on transfers.
- Never give one-time codes to anyone who calls you, even if they say they are the bank.
What about Zelle or other person-to-person payments?
If a scammer got into your account and sent money without your permission, that is generally an “unauthorized electronic fund transfer” under Regulation E, and the timing rules above apply. If you were tricked into sending the payment yourself, banks often argue the transfer was “authorized,” even though you were deceived, and Regulation E may not require a refund. Some banks reimburse certain impostor scams voluntarily, especially where the scammer pretended to be the bank. Report it right away and ask in writing for the bank’s position.
Does it matter whether the account is personal or business?
Very much. Regulation E protects consumer accounts. Business accounts are governed mainly by the bank’s contract and, for wires, UCC Article 4A. Businesses usually bear more of the risk, especially if they declined security procedures the bank offered, such as dual approval or positive pay. Review your business banking agreement now, before anything happens.
What should I keep for the bank and the police?
- Bank statements showing each disputed transaction, with dates and amounts.
- Emails, texts, call logs and screenshots of any contact with the scammer.
- Copies of the checks, if checks were used, including the back (endorsement).
- Your written notice to the bank and the date you sent it.
- Reports to the police and to the FBI’s Internet Crime Complaint Center (IC3).
What if the bank says no?
Ask for the bank’s written explanation and the documents it relied on. You can file a complaint with the Consumer Financial Protection Bureau or the bank’s regulator, which often prompts a second look. Depending on the amount and the facts, a demand letter from counsel or a claim in court or arbitration may be appropriate. Deadlines in bank agreements and statutes can be short, so do not wait.
Sources: N.Y. U.C.C. §§3-403, 3-406, 4-401, 4-406; U.C.C. Article 4A (§§4A-108, 4A-202, 4A-505); Electronic Fund Transfer Act and Regulation E, 12 C.F.R. §§1005.6, 1005.11; Patco Constr. Co. v. People’s United Bank, 684 F.3d 197 (1st Cir. 2012). As of November 2026.
