Updated August 3, 2026. Quick answer: move in this order — the bank first, within hours, then the regulators, then your own records. And two hard truths most pages skip: if you were tricked into sending the money yourself, the main federal protection may not apply, and for tax year 2026 an ordinary scam loss is not deductible.
Hour one: the bank, and only the bank
Everything recoverable is recoverable early. Call the number on your card or statement — not one from an email — say the words “I am reporting fraud and I want the transfer recalled”, and ask them to note the time you called. A recall is a request to the receiving bank; it works when the money is still sitting there, which is a matter of hours, not days.
Report it in writing as well as by phone, and keep the copy.
The hard truth about Regulation E
Regulation E is the rule people mean when they say “the bank has to refund fraud”. It is keyed to a defined term. Under 12 CFR § 1005.2(m), an unauthorized electronic fund transfer is “an electronic fund transfer from a consumer’s account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit”.
Read that carefully, because the whole question turns on it. If a fraudster took your credentials and moved money without you, the transfer was initiated by someone other than you — that fits, and the protections engage. But if you were deceived into making the payment yourself, the transfer was initiated by you, and it does not fit the definition. The protections are keyed to that term.
This is the gap that catches people in exactly the scams that target older adults — the “move your money to a safe account” call is built to make you press the button.
What we are not claiming: we could not locate CFPB sub-regulatory guidance addressing fraud-induced authorised payments specifically. The regulation’s text is quoted above; we are not telling you the agency’s position beyond it, and a bank may still choose to make you whole. Ask, in writing.
Wires are outside Regulation E entirely
12 CFR § 1005.3(c)(3) excludes transfers through Fedwire or a similar wire transfer system. A consumer wire is not covered at all — which is why fraudsters ask for wires.
The deadlines, if it is an unauthorized transfer
| Step | Deadline |
|---|---|
| You notify the institution | no later than 60 days after the institution sends the periodic statement showing the alleged error |
| Institution investigates | 10 business days, extendable to 45 days if the institution provisionally credits the account within the original 10 business days |
| Longer window (POS debit, new accounts) | 20 business days / 90 days for point-of-sale debit transactions and accounts open less than 30 days |
12 CFR 1005.11.
The 60 days runs from the statement, not from when you found out. Anyone who does not read statements promptly can lose the right before knowing there was anything to report.
Then report it — and know which report does what
- Your bank — the only step that can actually claw money back.
- IC3 (ic3.gov) — the FBI’s complaint centre. It feeds investigations and the national statistics; it is not a refund route.
- ReportFraud.ftc.gov — the FTC’s intake, likewise investigative and statistical.
- SEC or FINRA if an investment or a purported investment professional was involved.
- Your state securities or insurance regulator, depending on what was sold.
Report anyway, even knowing most of these will not return your money. Aggregate reporting is how patterns get identified, and it is free.
The tax question, and the answer people do not expect
An ordinary scam loss is not deductible for tax year 2026. Under 26 U.S.C. 165(h)(5)(A), a personal casualty or theft loss is allowed “only to the extent it is attributable to a Federally declared disaster … or a State declared disaster”.
This was widely expected to lapse: the limitation was originally written to run only for tax years beginning before 1 January 2026. It did not lapse. Public Law 119-21 struck out the words “, and before January 1, 2026”, leaving the limitation with no end date, and separately broadened it to cover State declared disasters as well. Both changes apply to tax years beginning after 31 December 2025.
So the position is the opposite of what a 2024-vintage article would tell you, and it is worth stating bluntly: being defrauded does not produce a deduction.
Investment fraud is a different rule, and this matters
A loss from a Ponzi-type investment fraud is not analysed as a personal casualty loss at all. It falls under section 165(c)(2) as a loss on a transaction entered into for profit, so the disaster limitation does not reach it. Revenue Procedure 2009-20 offers an optional safe harbour — 95% of the qualified investment where the investor is not pursuing third-party recovery, 75% where they are — and its text carries no sunset.
The distinction is worth taking to a preparer rather than resolving from any article. Two people who both “lost money to a scam” can land on opposite sides of it.
Related: when the credentials check out but the person is not who they say · what the reported numbers actually show.
General information drawn from federal regulator and law-enforcement publications, not legal or investment advice. This page describes patterns reported by regulators; it does not accuse any company or person of wrongdoing. Sources and read dates are given so you can check them yourself.
For professionals, and for anyone helping someone else: this page is designed to print as a clean handout. Press Ctrl+P (Cmd+P on a Mac) and the site navigation drops away, leaving the guide and its sources.
Free to print, copy and share for any purpose, including commercially, with attribution — Creative Commons Attribution 4.0 (CC BY 4.0). No permission needed and no need to tell us. More printable guides, and the licence in full.