On Reg E and account takeover, the short answer is that the bank usually pays. When a criminal takes over a consumer's online banking and moves money electronically, Regulation E treats the transfer as unauthorized, even if the customer was tricked into handing over the password or the one-time code, and it caps the customer's share by how quickly they report: at most $50 if they tell the bank within two business days of learning of it. Business accounts sit under a different law, Article 4A of the Uniform Commercial Code, and wires raise questions of their own. For a head of fraud or a CFO the arithmetic is simple: on consumer accounts, nearly every dollar that leaves in a takeover is the bank's dollar. Botminds' Account Takeover Fraud Prevention exists to act while the money is still in the account, inside the hold window, rather than after the claim arrives.
The worked case on this page is sample data on fictional people at a fictional bank, Corvane National Bank, as it runs through the solution. The rules are quoted from the regulation, the CFPB's published answers and the Uniform Commercial Code; none of this page is legal advice.
Is account takeover covered by Reg E? When the account is a consumer's and the transfer is electronic
Yes, for consumer accounts and electronic fund transfers. Regulation E treats an electronic fund transfer as unauthorized when someone other than the consumer starts it, without actual authority, and the consumer gets no benefit from it (12 CFR 1005.2(m); the guide to Zelle and Regulation E quotes the definition). A criminal who logs in with stolen credentials and sends an ACH transfer, a bill payment, a person-to-person payment or a debit from a consumer checking account fits that definition.
The CFPB's published answers spell it out for stolen credentials: when a consumer's account access information is obtained "through fraudulent means such as computer hacking, and a hacker uses that information to make an EFT from the consumer's account, the transfer is an unauthorized EFT under Regulation E" (CFPB, Electronic Fund Transfers FAQs). The regulation's exclusions are narrow: transfers by someone the consumer gave the access device to and has not revoked, transfers with the consumer's own fraudulent intent, and transfers by the bank itself.
Two edges matter for takeover. The account must be a consumer account, "established primarily for personal, family, or household purposes"; a business account is not. And the transfer must be an electronic fund transfer; the regulation leaves out transfers over Fedwire and similar wire systems used mainly between banks or between businesses (12 CFR 1005.3(c)(3)). Both edges are discussed below.
What if the customer gave the fraudster the code? The CFPB's answer
It is still unauthorized. This is the question most banks get wrong, and the CFPB answered it directly in its Electronic Fund Transfers FAQs. Its fifth question on unauthorized transfers reads: "A third party fraudulently induces a consumer into sharing account access information that is used to initiate an EFT from the consumer's account. Does the transfer meet Regulation E's definition of an unauthorized EFT?" The bureau answered yes.
"Similarly, when a consumer is fraudulently induced into sharing account access information with a third party, and a third party uses that information to make an EFT from the consumer's account, the transfer is an unauthorized EFT under Regulation E."
CFPB, Electronic Fund Transfers FAQs, Error Resolution: Unauthorized EFTs, Question 5
The bureau's first example is the takeover pattern itself: a caller posing as the consumer's bank who talks the consumer into reading out a login, a texted confirmation code, a debit card number or anything else that can move money out of the account. It then closed the obvious argument, that a customer who reads out a code has "furnished" an access device and so authorised the criminal. The answer is no: a consumer tricked into giving up account information has not furnished an access device under Regulation E.
The line falls elsewhere for scams in which the customer sends the money. A customer who is persuaded to log in and send a payment themselves has initiated the transfer; that is the authorized push payment problem, outside this question and covered by APP Fraud Detection. Takeover is the case where someone else is driving the session.
How much is a consumer liable for unauthorized transfers? Three tiers and two adjustments
A consumer's liability depends on when they tell the bank. If they report within two business days of learning that their access device was lost or stolen, their liability "shall not exceed the lesser of $50 or the amount of unauthorized transfers that occur before notice to the financial institution" (12 CFR 1005.6(b)(1)). After that it rises to a $500 cap, and transfers that continue after an unreported statement can fall to the customer without a cap.
Who pays in a consumer account takeover under Regulation E, by when the customer reports
Customer tells the bank within two business days of learning the credentials or device were lost or stolen
Customer's mostThe lesser of $50 or the transfers made before notice
The bank's shareEverything above that
Customer tells the bank after two business days
Customer's mostUp to $500: the first tier, plus later transfers the bank shows would not have happened with timely notice
The bank's shareEverything else
An unauthorized transfer on a statement is not reported within 60 days of the statement being sent
Customer's mostTransfers after day 60 and before notice that the bank shows timely notice would have prevented, with no cap
The bank's shareTransfers up to day 60, within the limits above
Delay caused by extenuating circumstances, such as travel or illness
Customer's mostThe time limits are extended "to a reasonable period"
The bank's shareAs above, on the extended clock
State law or the account agreement sets a lower limit
Customer's mostThe lower limit applies
The bank's shareThe rest
The notice rule deserves a second reading by any fraud team. Notice is given "when a consumer takes steps reasonably necessary to provide the institution with the pertinent information", and it "may be considered constructively given when the institution becomes aware of circumstances leading to the reasonable belief that an unauthorized transfer to or from the consumer's account has been or may be made". A bank whose own monitoring sees the takeover may have been given notice by its own alert. In practice, most takeover victims who are reached by the bank fall into the first tier.
Why carelessness and account terms do not shift the loss to the customer
A bank cannot charge a takeover victim more because they were careless, and it cannot write the protection away in the account agreement. The CFPB's FAQs point to the official commentary, which rules out using a consumer's negligence to impose more liability than Regulation E allows, and gives as its example a PIN written on the card itself.
On agreements, the bureau was as direct. A clause waiving Regulation E protections "if a consumer has shared account information with a third party" does not work: "an agreement cannot restrict a consumer's rights beyond what is provided in the law, and any contract or agreement attempting to do so is a violation of EFTA". Network rules that make a payment final between banks do not change the consumer's protection either. The customer who typed a password into a phishing page is, for liability purposes, in the same position as one whose password was stolen in a breach.
That is the economic heart of the matter. Most of the levers a bank might use to share the loss with a consumer are closed, so the only large lever left is to stop the transfer before it settles.
Does Reg E cover wire transfers? The exclusion, and what the Citibank case changed
Not as a rule: Regulation E excludes transfers through Fedwire or similar systems used primarily between financial institutions or businesses, and Article 4A of the Uniform Commercial Code governs those funds transfers instead. But Article 4A itself steps aside for any funds transfer that the Electronic Fund Transfer Act governs even in part (UCC §4A-108), and that overlap is now being tested for consumers whose online banking was used to send a wire.
In January 2024 the New York Attorney General sued Citibank, alleging it failed to protect and reimburse customers whose accounts were hacked and whose money was stolen. In January 2025 a federal judge denied Citi's motion to dismiss the core claims. According to the Attorney General's announcement, "the court found that a landmark consumer protection law known as the Electronic Fund Transfer Act (EFTA) applied to unauthorized wire transfers made through Citi's consumer accounts" (New York Attorney General, January 21, 2025). The Attorney General's other statements in that release, about Citi's security and monitoring, are allegations, and the case was continuing as of that announcement.
For a bank, the safe reading is that a consumer wire started from a hijacked online banking session is no longer a place to assume the customer bears the loss. Wires are also where takeovers are largest: the FBI's November 2025 warning described criminals who "quickly wire funds to other criminal-controlled accounts, many of which are linked to cryptocurrency wallets".
Does Reg E apply to business accounts? Article 4A decides instead
No. Regulation E covers accounts held primarily for personal, family or household purposes, so a takeover of a business's online banking falls under Article 4A for wires and ACH credits. There the question is not how fast the customer reported, but whether the bank's security procedure was a commercially reasonable protection against unauthorized payment orders and whether the bank followed it in good faith (UCC §4A-202(b)). If both are true, the business bears the loss; if not, the bank must refund, with interest (UCC §4A-204).
That shifts the bank's work from claims to contracts and controls: the security procedure offered, the customer's choices, the monitoring the bank actually does. The two court cases that shaped the standard, and what a policy needs to say as a result, are in the guide to corporate account takeover policy.
How much does account takeover cost banks? One completed transfer, priced
For a consumer takeover reported promptly, the direct cost is the transfer less at most $50, plus the work of the claim, less whatever is recovered from the receiving bank. Recovery is real but partial: in 2025 the FBI's Recovery Asset Team froze $679 million of $1.16 billion in attempted thefts it worked through its Financial Fraud Kill Chain, a 58% success rate, and that is for incidents reported quickly enough to try (FBI IC3, 2025 Annual Report).
What one completed consumer takeover costs, and what stopping it saves
Reimbursed loss
transfer amount − customer's share (at most $50 on prompt notice)
In the sample case, $9,750.00 − $50.00 = $9,700.00 the bank would have borne.
Disputes and finance
Claim work
claims × hours to investigate, decide and write to the customer
Regulation E error resolution has its own clocks and notices; the work starts whenever money leaves.
Disputes
Recovery
amount frozen or returned by the receiving bank
Partial and uncertain: the FBI's Kill Chain froze 58% of attempted thefts it worked in 2025.
Fraud operations
Cost of stopping it
analyst and outreach minutes inside the hold window + checker time
The product's own estimate: about 26 minutes for an escalated case with the solution, against about 105 by hand.
Fraud operations
The asymmetry is the argument. A completed $9,750.00 takeover costs about $9,700.00 plus a claim, and maybe some of it comes back. A stopped one costs a phone call, a hold, a restore and a second person's check. In the sample case those took from 2:11 PM, when the analyst opened the case, to 2:31 PM, when the supervisor approved the restore.
Stopped or reimbursed: what Account Takeover Fraud Prevention's hold window is worth
The same arithmetic, applied to a week, shows where the money goes. In the sample bank's week of 12 to 18 October, 35 takeovers were confirmed. Thirty-three were stopped before money left, keeping $311,250.00 in customers' accounts. Two had completed before any alert, and $6,950.00 was reimbursed under Regulation E.
A sample week of confirmed takeovers: money kept versus money reimbursed
Each stopped case carries its own Regulation E position, so the finance view is not a guess. In Gloria Henshaw's case the position reads: no money left, no claim, and $9,700.00 the bank would have borne if the transfer had gone. The letter to her says the same thing in plain words, and the controls panel ties what failed and what worked to the FFIEC guidance.
The case file in Account Takeover Fraud Prevention, with its Regulation E position and the controls that failed
When money has already left: handing the claim to disputes
Once a takeover transfer has settled, the customer's report is a notice of error, and Regulation E's error resolution rules, with their own deadlines, provisional credit and written notices, take over. That is claim work, and it belongs to the disputes team; the steps and clocks are covered by Botminds' Reg E Dispute Management, and person-to-person claims by P2P Fraud Claims.
What the fraud team can do is make that claim short. In Account Takeover Fraud Prevention, a completed takeover transfer is handed to disputes with the strip, the cited signals and the outreach notes, so the investigation starts with the evidence that the transfer was not the customer's. The FFIEC also asks banks to explain to customers "the legal and other rights and protections a customer may have in the event of unauthorized access to an account, including protections under Regulation E"; a bank that tells customers early is a bank that hears about takeovers early, inside the $50 tier.
The numbers behind the problem are set out in the guide to account takeover fraud statistics, and the difference between takeover and new-account identity theft, which falls under different rules, in the guide to account takeover fraud vs identity theft. To see the Regulation E position worked on your own past cases, start from Account Takeover Fraud Prevention.
Questions people ask
Who is liable for account takeover fraud?
On a consumer account, mostly the bank: Regulation E treats the takeover transfer as unauthorized and caps the customer's share at $50 if they report within two business days of learning of it, $500 if later, with more exposure only for transfers after an unreported statement's 60 days. On a business account, Article 4A decides, and the business bears the loss if the bank followed a commercially reasonable security procedure in good faith.
Does Reg E cover phishing?
Yes, when a criminal uses the phished credentials to make the transfer. The CFPB lists "a third party using phishing or other methods to gain access to a consumer's computer and observe the consumer entering account login information" among situations that are unauthorized transfers. It is different when the customer is persuaded to send the money themselves.
Can a bank deny a Reg E claim because the customer shared their password?
Not on that ground alone. As above, a consumer tricked into handing over account information has not furnished an access device, and consumer negligence cannot increase liability beyond what Regulation E allows. An account-agreement clause saying otherwise is, in the bureau's words, "a violation of EFTA".
Does the $50 limit apply if the bank detects the takeover first?
Regulation E allows notice to be "constructively given when the institution becomes aware of circumstances leading to the reasonable belief that an unauthorized transfer" has been or may be made. A bank that detects a takeover and reaches the customer the same day will usually be in the first tier, as in the fictional sample case, where the customer's most was $50.
Does Reg E cover Zelle and other person-to-person payments in a takeover?
Yes, when the payment is made by someone who took over the account. The CFPB's FAQs say a credit-push person-to-person transfer started by a third party who got into the consumer's account by fraud is an unauthorized EFT, and that network rules on finality do not reduce the consumer's protection.