Quick answer
If someone got into your bank account or Zelle and sent the money without your permission, federal law generally requires your bank to investigate and refund you, as long as you report it on time. If you sent the money yourself because a scammer tricked you, the bank usually doesn't have to refund it, but report it right away anyway: some banks reimburse certain impostor scams.
Key takeaways
- Zelle runs inside your bank's app, so your claim is with your bank.
- Money a hacker or scammer sent from your account is an unauthorized transfer, and the bank must investigate.
- If a scammer tricked you into sharing a code or login and then sent the money, that can still count as unauthorized.
- Payments you sent yourself are usually treated as authorized, but report them: some banks reimburse impostor scams.
- Report within 60 days of the statement showing the transfer, and in writing.
Common Zelle scams
- A fake "bank fraud department" call or text tells you to send money to yourself or a "safe account" to stop fraud.
- Someone gets your login or a one-time code and drains your account with Zelle payments.
- A seller on a marketplace takes a Zelle payment and never delivers. Zelle has no purchase protection.
- A stranger "accidentally" sends you money and asks you to send it back.
Hacked or tricked? Why it matters
Federal law (the Electronic Fund Transfer Act and its rule, Regulation E) protects you from unauthorized transfers: money moved out of your account by someone else, without your permission. If someone got into your account and sent the money, that's unauthorized, and your bank or the app generally has to investigate and refund you.
The Consumer Financial Protection Bureau has said that if a scammer tricks you into handing over your login or a one-time code and then sends the money themselves, that also counts as unauthorized.
If you sent the payment yourself, even because a scammer lied to you, it's usually treated as authorized, and the bank doesn't have to refund it under that law. Report it anyway: some banks and apps reimburse certain scams voluntarily, and the facts often turn out to be less clear-cut than they first seem.
Deadlines that protect your money
- Report as soon as you notice. If a card, phone, or login was lost or stolen, telling your bank or the app within 2 business days limits what you can lose.
- Report within 60 days after the statement that first shows the transfer, or you can lose protection for later unauthorized transfers.
- After you report, the bank or app generally has 10 business days to investigate, or up to 45 days if it gives you a provisional credit while it finishes.
- If your claim is denied, it must explain why in writing, and you can ask for copies of the documents it relied on.
What to do next
- Call your bank's fraud line now, then follow up in writing (a secure message or letter) so you have proof of the date.
- Say clearly whether you sent the payment or someone else did, and whether anyone got your code or login.
- Change your banking password and turn on two-step verification.
- Report the scam to the FTC at ReportFraud.ftc.gov.
- If your bank denies the claim, ask for the documents it relied on and request a free case review.
Frequently asked questions
Sources
- Regulation E, 12 C.F.R. § 1005.2(m) (definition of an unauthorized electronic fund transfer)
- Regulation E, 12 C.F.R. § 1005.6 (limits on your liability and reporting deadlines)
- Regulation E, 12 C.F.R. § 1005.11 (how banks and apps must investigate errors)
- Consumer Financial Protection Bureau: Electronic Fund Transfers FAQs (including fraudulently obtained account access)
- Electronic Fund Transfer Act, 15 U.S.C. § 1693m (damages and attorney's fees)
- Federal Trade Commission: report fraud
This website provides general information, not legal advice. Laws change and every situation is different. Talk to a licensed attorney in your state about your specific facts.
More on this topic: Your rights after an unauthorized transfer