If a family member stole money from your bank account, whether the bank must refund it depends on authority, not on family. Regulation E treats a transfer as unauthorized when someone other than the account holder made it without actual authority, and the account holder got no benefit from it. A relative who took the card, learned the PIN or used the phone without permission made unauthorized transfers, and the account holder's liability is limited exactly as for any other theft. A relative the account holder handed the card to, who then spent more than he was allowed, is a different case: the account holder is responsible for those transfers until he tells the bank that person is no longer authorized. For banks this is the hardest kind of first-party claim, because the device, the home network and the sign-in all point at the household, not at a person. Botminds' First-Party Fraud Detection, software for investigators deciding likely false Reg E claims, says so on screen instead of guessing.
Four household cases, and how Regulation E treats each
| What happened | Under Reg E | Who bears the loss |
|---|---|---|
| A relative took the card, phone or PIN without the customer’s permission | Unauthorized: started by someone other than the customer, without authority | The bank, apart from a customer share of up to $50, or up to $500 if he reported late |
| The customer gave a relative the card to buy groceries; the relative emptied the account | Not unauthorized: authority given and exceeded (comment 2(m)-2) | The customer, until he notifies the bank; after that, unauthorized |
| A relative tricked or forced the customer into handing over the card or code | Unauthorized: a device obtained through fraud or robbery was never furnished (comment 2(m)-3) | The bank, within the liability tiers |
| The customer and a relative arranged the transfer and then disputed it | Not unauthorized: fraudulent intent by the consumer or someone acting in concert (1005.2(m)(2)) | The customer; the bank must still prove it |
Will the bank refund money a family member took?
Yes, if the relative had no authority to use the account, and once the bank's investigation finds the transfers unauthorized. The customer may still bear a small share, $50 if he reported within two business days of learning his card or code was taken, up to $500 if later, and more only for transfers after 60 days from the statement that showed them. No, for transfers the customer had allowed, until he tells the bank that person may no longer use his card or account.
The bank cannot decide this by who the relative is. A son who lives at home is not automatically authorized, and a parent who once held the card is not automatically a thief. What the bank needs, and what the customer should be ready to give, is a clear account of who had the card, phone or code, what they were allowed to do with it, and when that changed.
The rule turns on authority, not on family
Regulation E's definition has three parts, and all three must hold for a transfer to be unauthorized: started by a person other than the consumer, without actual authority to start it, and bringing the consumer no benefit. Its first exclusion is the one that governs households: a transfer by a person the consumer gave the access device to is not unauthorized until the consumer tells the bank that person's transfers are no longer authorized (12 CFR 1005.2(m)(1)).
"Access device" is wide: Regulation E defines it as "a card, code, or other means of access to a consumer's account, or any combination thereof, that may be used by the consumer to initiate electronic fund transfers". In a modern household that reaches a debit card and its PIN, an online banking password, and a phone set up to approve payments. So the question is always the same, whatever the payment: did the customer give this person the means to make transfers?
"I gave my son my card": when authority is exceeded
The account holder is liable for everything the relative does with the card until he revokes the authority, even beyond what he allowed. The Official Interpretation puts it in one sentence: "If a consumer furnishes an access device and grants authority to make transfers to a person (such as a family member or co-worker) who exceeds the authority given, the consumer is fully liable for the transfers unless the consumer has notified the financial institution that transfers by that person are no longer authorized."
The rule is blunt because the bank had no way to know. The card and PIN worked as the customer meant them to; only the customer knew the limit he had set, so only he can end it. That is also why the date of his notice to the bank is the most important fact in the claim.
An illustration: authority given, exceeded, then revoked
- Card lent for groceriesAuthorized use
- Withdrawals beyond the limitExceeded
- After the customer tells the bankRevoked
- The customer bears themcomment 2(m)-2
- The bank, from the noticeunauthorized
How do you revoke a relative's authority, and why does the date matter?
By telling the bank, in any reasonable way, that the person may no longer make transfers, and then cancelling the card or changing the PIN, password or phone. Regulation E lets a consumer notify the bank "in person, by telephone, or in writing", treats notice as given when he "takes steps reasonably necessary" to provide it, and counts written notice from the moment it is mailed (12 CFR 1005.6(b)(5)). Notice can even be constructive, when the bank becomes aware of circumstances that point to unauthorized use.
The date matters because it splits the transfers in two. Everything the relative did with the card before the notice was within authority the customer gave, even if he exceeded it. Everything after is unauthorized, and the bank must investigate and correct it like any stolen card. A customer who keeps a note of the day and time he called, and the name of the person he spoke to, has the one fact that settles most household claims.
When the relative took the card or the code without asking
Then the transfers are unauthorized, and being family changes nothing. A card or code taken from a drawer, a PIN learned by watching, a phone unlocked while its owner slept: none of these is a device the customer furnished. The commentary goes further for pressure and deceit: a transfer by someone who got the device from the consumer by fraud or robbery is unauthorized, and so is a cash withdrawal at an ATM the consumer was forced to make (comments 2(m)-3 and 2(m)-4).
The customer's share then depends only on how fast he reported once he knew: up to $50 within two business days, up to $500 after that, and more only for transfers after the 60-day statement window that the bank shows a timely report would have stopped. Writing the PIN on a piece of paper in the same wallet does not raise that share, because negligence cannot increase liability under Regulation E. The arithmetic, with a calculator, is in the Reg E liability calculator.
The clocks that still run in a household claim
2
business days from learning the card or code was taken, to keep the share at $50 or less
$500
most the customer can owe for a late report inside the statement window
60days
from the statement showing the transfers, to keep later ones covered
10
business days for the bank to decide, or credit provisionally while it investigates
Do you have to press charges against a family member?
No, not for the bank to investigate. The bank may ask for a written statement about the claim, but it may not hold up its investigation waiting for one, and it cannot make a police report a condition of investigating. The CFPB has cited institutions that denied claims without looking at their merits because no affidavit came back, and has said plainly that neither a police report nor other paperwork can be made a condition of starting or finishing the investigation (Supervisory Highlights 26).
Many customers do not want a relative prosecuted, and some fear what reporting would do at home. The rule does not make them choose between their family and their money. What they do need to give the bank is their account of authority: who had the card, what they were allowed, and when that ended. If the relative was a caregiver or held a power of attorney, the Federal Reserve's FraudClassifier model would class the misuse as embezzlement by someone trusted with the funds, a reminder that the person who took the money may have been entrusted with it, not merely living in the house.
What the bank's records can and cannot show inside a household
The records show the household; they rarely show the person. A transfer from the customer's registered phone, on the home network, after a biometric sign-in, is exactly what a family member with access to the phone produces. That is why a first-party denial that rests on device and location can be wrong in a home where the phone is shared, and why the bank's burden of proving authorization (15 U.S.C. 1693g(b)) bites hardest here.
In the fictional sample bank behind this series, the agents state the limit beside every proposal that rests on device evidence. On one disputed P2P payment the proposal reads "Deny with evidence", and the limit beside it reads that Face ID cannot rule out someone in the customer's household with his phone; he had said no one else uses it. If he had said otherwise, the claim would have turned on his account of authority, not on the device.
The limit is stated beside the proposal, not left for the customer to discover
The same bank's monthly review shows the limit at work. In September, investigators paid six claims the agents had proposed to deny, and in two of them the reason recorded was that a household member had the phone. That is the system working: the investigator asked, the customer answered, and the answer changed the finding. When the customer brings that answer after a decision, the sample's "Tell us something new" reopens the claim and the agents run again.
What the customer can do after a decision
What to tell the bank when a relative took the money
Tell it early, and tell it about authority. The faster the report, the smaller any share of the loss; the clearer the account of who could use the card, the sooner the investigator can separate allowed use from theft. The investigator, in turn, should ask about the household before deciding, because the records cannot.
Five things that settle most household claims
- Who had the card, phone, PIN or password, and since when?
Name the person and how they got it: given, borrowed, taken or tricked out of you.
- What were they allowed to do?
A limit you set, such as groceries or one bill, matters even if they went beyond it.
- When did you tell the bank to stop them?
The date and time of the call, chat or letter. Transfers after it are unauthorized.
- When did you first learn the money was gone?
Your two business days run from then, counted from the next business day.
- What did you do to stop further use?
Card cancelled, PIN and password changed, phone locked or removed from the account.
For banks, the household claim is the clearest argument for looking at the genuine side of every claim first, and for keeping earlier claims and suspicion out of the decision. How the regulation's definition sorts these cases is set out in what Reg E says about friendly fraud, and the reasons a denial can never rest on are in Reg E denial reasons.
Questions people ask
Is it fraud if a family member used my card?
If you did not give them the card or PIN, yes: under Regulation E their transfers are unauthorized and your bank must investigate. If you gave them the card and they spent more than you allowed, Regulation E treats those transfers as yours until you tell the bank they are no longer authorized.
Can a bank deny a claim because a relative made the transfer?
Not because of who made it. The bank has to establish, from its records and your account, that you gave that person the means to make transfers and had not revoked it, or that you acted together; without that, a transfer by a relative who took your card is unauthorized like any other.
What if the relative tricked me into sharing my code?
Then you did not furnish an access device. The CFPB treats account access obtained through fraudulent inducement as unauthorized use, and the commentary treats a device obtained by fraud or robbery as never furnished, so the bank investigates the transfers as unauthorized.
Does writing my PIN down make me liable?
No. Regulation E's commentary says negligence cannot be used to impose more liability than the rule allows, and gives writing the PIN on the card or on paper kept with it as the example.
How long do I have to report a relative's transfers?
Report within two business days of learning your card or code was taken to keep your share at $50 or less, and in any case within 60 days of the statement that shows the transfers. Extended travel or hospitalisation extends both windows.