Regulation E says nothing about friendly fraud by that name: the words "friendly fraud" and "first-party" do not appear anywhere in 12 CFR Part 1005 or its Official Interpretations. What Reg E says is more precise. An unauthorized electronic fund transfer is one "initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit", and the definition excludes three kinds of transfer, including one made with the consumer's own fraudulent intent. A claim the industry calls friendly fraud is, in Reg E's terms, a transfer that was never unauthorized, and the bank has to show that from its own records. Botminds' First-Party Fraud Detection, software for dispute investigators handling likely false claims, is built on exactly that reading.
12 CFR 1005.2(m), clause by clause, and what each asks the bank to show
“Unauthorized electronic fund transfer” means an electronic fund transfer from a consumer’s account…
Initiated by a person other than the consumer
The customer did not start the transfer himself.
The bank showsWhich device, credentials and session started it, and whose they are.
Without actual authority to initiate the transfer
The person who started it had no authority from the customer.
The bank showsWhether the customer gave anyone the card, phone or password, and when.
From which the consumer receives no benefit
The money did not end up serving the customer.
The bank showsWhere the money went, and the customer’s earlier dealings with the recipient.
The term does not include an electronic fund transfer initiated:
1A person the consumer gave the access device to
“By a person who was furnished the access device to the consumer’s account by the consumer, unless the consumer has notified the financial institution that transfers by that person are no longer authorized”
The bank showsThat the device was handed over, and that no revocation came before the transfer.
2Fraudulent intent
“With fraudulent intent by the consumer or any person acting in concert with the consumer”
The bank showsThat the customer, or someone acting with him, made the transfer and claimed otherwise.
3The bank itself
“By the financial institution or its employee”
The bank showsNot a defence for the bank: a consumer has no liability for a transfer its employee started.
Friendly fraud is an industry term, not a Reg E term
Friendly fraud is the trade's name for a dispute of a transaction the customer made or approved. The label is borrowed from card chargebacks, where a cardholder disputes a purchase he received, and it travels badly into Reg E work for two reasons. It suggests the motive matters more than the evidence, and it lumps together cases the regulation treats differently: a customer who lies, a customer whose relative used his card, and a customer who honestly misremembers.
Reg E asks one question of every claim of an unauthorized transfer: did someone other than the consumer start it, without authority, for no benefit to him? If the answer is no, there is no unauthorized transfer and no error to correct. If the bank cannot show the answer is no, the claim is paid. Intent matters only in exclusion 2, and even there it is something the bank must establish, not something it can infer from a feeling about the customer.
Card disputes add a second rulebook. A credit card claim falls under Regulation Z and the card networks' own rules, and the line between an unauthorized charge and a billing error runs differently there; our card dispute series explains it. This page stays with Regulation E: debit cards, ACH, ATM and P2P transfers from consumer deposit accounts.
The definition of an unauthorized transfer, read clause by clause
Three conditions must all hold for a transfer to be unauthorized: someone other than the consumer started it, that person lacked actual authority, and the consumer got no benefit. Each points the investigator at different records. The first is about devices, credentials and sessions. The second is about what the customer allowed: whom he gave a card, a phone or a password to. The third is about where the money went.
The commentary widens the first two in the consumer's favour. A transfer "initiated by a person who obtained the access device from the consumer through fraud or robbery" is unauthorized, and so is an ATM withdrawal the consumer was forced to make (comments 2(m)-3 and 2(m)-4). A consumer also has "no liability for erroneous or fraudulent transfers initiated by an employee of a financial institution", which is why exclusion 3 is never a reason to deny.
"No benefit" deserves care. A P2P payment to a stranger benefits nobody the customer knows. A payment to a roommate for a shared rent may well benefit him, and a history of such payments is evidence about benefit as much as about authority. In the fictional sample claim behind this series, the disputed $740.00 went to a recipient the customer had paid 14 times since March 2025, each time between $680 and $760, with the memo "rent split".
When the customer handed over the card or the phone
Exclusion 1 covers transfers by someone the customer gave the access device to. It lasts until the customer tells the bank that person's transfers are no longer authorized, and the commentary spells out the hard case: a relative or co-worker who was given the card and goes beyond what the customer allowed leaves the customer fully liable until he notifies the bank (comment 2(m)-2).
The CFPB has drawn the boundary of "furnished" sharply. Answering whether a consumer tricked into sharing account access has furnished an access device, its EFT FAQs say: "No. A consumer who is fraudulently induced into providing account information has not furnished an access device under Regulation E." A customer who read a one-time code to a caller posing as the bank has not handed over his account; the caller's transfers are unauthorized. The household version of exclusion 1, and how a revocation date decides it, is worked through in when a family member took the money.
Fraudulent intent, by the consumer or anyone acting in concert
This is the clause that friendly fraud actually falls under. A transfer the consumer made with fraudulent intent, alone or with someone acting in concert with him, is outside the definition, so a customer who sends a payment and then claims a stranger did has no unauthorized transfer to claim. "Acting in concert" closes the obvious gap: a friend who makes the transfer by arrangement and a customer who then disputes it are treated as one.
The clause does not lower the standard of proof. Fraudulent intent is a finding about a person, and a denial resting on it has to be supported by records about this transfer: who started it, from what device, from where, to whom. A history of earlier claims is not such a record, and the CFPB has cited banks that denied claims because of a customer's earlier dealings with the merchant. In the sample, the customer's three earlier claims since May appear on the screen only as context.
Earlier claims and links, kept as context and never as the reason
Is a scam victim's transfer friendly fraud?
No. A scam victim believes what he is telling the bank, and Reg E treats two kinds of scam differently from each other and from friendly fraud. If a fraudster tricked the customer into sharing a code or password and then sent the money himself, the transfer is unauthorized: the CFPB's FAQs treat a payment a third party makes with access information it tricked out of the consumer as an unauthorized EFT, a case Reg E and account takeover works through.
If the customer sent the money himself, believing a lie, the transfer was authorized, and Reg E's protections for unauthorized transfers do not reach it. The Senate Permanent Subcommittee on Investigations' staff put the distinction in plain terms in 2024: federal law makes the platform repay unauthorized transfers, which Zelle calls fraud, and not authorized ones, which it calls scams; Zelle scam reimbursement follows what that has meant for victims. The bank still has to investigate his notice of error. What it may not do is treat a deceived customer as a dishonest one.
What people call it, and the question Reg E actually asks
| What people call it | The question under Reg E | Where the answer comes from |
|---|---|---|
| Friendly fraud, first-party fraud | Did the consumer, or someone acting in concert with him, make the transfer and then claim otherwise? | 1005.2(m)(2); the bank’s burden under 15 U.S.C. 1693g(b) |
| Family fraud | Did the customer give that person the card or phone, and had he revoked their authority before the transfer? | 1005.2(m)(1); comment 2(m)-2 |
| Account takeover | Did someone else start the transfer without authority, using stolen or guessed credentials? | 1005.2(m); CFPB EFT FAQs |
| Impostor scam, code shared | Was the customer fraudulently induced to share access information that a third party then used? | CFPB EFT FAQs: an unauthorized EFT; not a furnished access device |
| Impostor scam, customer paid | Did the customer start the transfer himself, deceived about what it was for? | Authorized: outside Reg E’s unauthorized-transfer protections |
Who has to prove fraudulent intent, and can a bank deny on it?
The bank proves it, and yes, it can deny on it, when the proof is there. Under the Electronic Fund Transfer Act, in any action over a consumer's liability for an unauthorized transfer, the bank carries the burden of showing the transfer was authorized (15 U.S.C. 1693g(b)), and it cannot deny any claim without a reasonable investigation, the floor Reg E fraud claims tests across two specialists. Federal Reserve staff draw the consequence for disputes: if the bank cannot establish that the transfer was authorized, "the transaction is considered an unauthorized EFT, and the institution must correct the error".
"When the alleged error is an unauthorized EFT, the EFTA places the burden of proof on the financial institution to establish that the transaction was authorized."
Federal Reserve staff, Consumer Compliance Outlook, Third Issue 2025
In practice that means a first-party denial needs several independent records pointing the same way, a search for what would make the claim genuine, and a written explanation. In the sample claim, a registered iPhone, a Face ID sign-in with no reset or new device in 90 days, the customer's home network, a chip-and-PIN purchase near home the next morning and 14 earlier payments to the recipient all point at the customer. The agents also state the limit: Face ID cannot rule out someone in his household holding his phone. A denial built that way says the payment was authorized; it does not need to say why the customer claimed otherwise.
Five questions that place a claim in Reg E's terms
- Who started the transfer?
The device, credentials and session behind it, and whether they belong to the customer.
- Did that person have the customer’s authority?
A card or phone handed over, a password shared, and any revocation with its date.
- Was the customer deceived into giving access?
A call, text or message from someone posing as the bank or a trusted party: if so, the transfer is unauthorized.
- Did the customer benefit?
Where the money went, and his earlier dealings with the recipient.
- Can the bank show it from its own records?
If not, the claim is an unauthorized transfer and the bank corrects it, within the liability limits.
How the Federal Reserve's FraudClassifier names friendly fraud
Where Regulation E speaks of fraudulent intent, the Federal Reserve's FraudClassifier model uses an operational label. Its first question is who initiated the payment; a customer who did so dishonestly falls under the branch for an authorized party acting fraudulently, and the dispute version is the false claim: a deliberate lie told to obtain a payment or to escape one.
The model is a classification aid, not law: its own terms disclaim any role in defining liability for losses or creating legal definitions (FedPayments Improvement). Used beside the regulation, it gives a disputes team a common label for each claim so that similar denials can be compared, which we set out in the FraudClassifier guide.
The friendly-fraud vocabulary, counted
0
times "friendly fraud" or "first-party" appears in Regulation E and its Official Interpretations
3
exclusions from the definition of an unauthorized transfer
1
exclusion that turns on the consumer’s fraudulent intent, or that of anyone acting in concert
3
fraud tactics under the FraudClassifier’s authorized-party-acted-fraudulently branch
Why the word fraud stays out of the customer's letter
Because the regulation asks for findings, not accusations, and because an accusation can disclose more than the bank may. When a bank finds no error, its report must explain its findings in writing and tell the customer he may ask for the documents it relied on (12 CFR 1005.11(d)(1)). A finding that the payment was authorized, with the records behind it, meets that duty; a finding that the customer committed fraud adds nothing the rule requires.
There is a second reason. If the bank refers the customer for suspicious activity, any report, and anything that would show one exists, is confidential (31 CFR 1020.320(e); a grand jury subpoena for bank records shows how far that reaches). A letter or a status screen that says "under fraud review" can come close to that line. In the sample, the customer's app shows the decision, four findings and two buttons, and a locked list of what it never shows.
What the customer sees, and what is locked out of every view
Questions people ask
What is friendly fraud?
It is the industry's name for a dispute of a payment the customer made or approved, such as a P2P payment he sent and later reports as unauthorized. Regulation E does not use the term; it excludes such a transfer from the definition of unauthorized when the consumer, or someone acting in concert with him, made it with fraudulent intent.
Is friendly fraud covered by Reg E?
The claim is covered: a bank must investigate it under 12 CFR 1005.11 like any other notice of error. The transfer is not an unauthorized transfer if the bank can show the customer made it or authorized it, in which case it reports a finding of no error in writing, with the right to the documents.
What is the difference between friendly fraud and first party fraud?
In disputes the two terms are used almost interchangeably for a customer who disputes his own transaction. First party fraud is broader: it also covers fraud at account opening, such as synthetic identities, which the Federal Reserve's FraudClassifier places on the same branch as a false claim.
Does Reg E cover a transfer by someone the customer gave the card to?
Not as an unauthorized transfer, until the customer tells the bank that person's transfers are no longer authorized. After that notice, transfers by that person are unauthorized. A device obtained from the customer through fraud or robbery was never furnished, so those transfers are unauthorized from the start.
Can a bank refuse to investigate a claim it suspects is friendly fraud?
No. Suspicion is where the investigation starts, not where it ends: the bank must investigate promptly, review its own records, and decide within 10 business days or credit the customer provisionally. Denials made without a reasonable investigation are a failure examiners have cited again and again since 2014.