Do banks really investigate fraud? What happens to your report

Do banks really investigate fraud? Yes. When you report an unauthorized electronic transfer from a personal account, such as a debit card charge, an online transfer or an ACH debit you did not make, Regulation E requires the bank to investigate promptly and decide within 10 business days, or to credit your account provisionally and take up to 45 days. It must tell you the result, and if it decides there was no fraud, it must explain why in writing and tell you that you can ask for the documents it relied on. Behind that, your report becomes a case: an investigator gathers your transactions, the records of who logged in and from what device, any check images and your call, decides, and a second person approves any money returned to you. It is slower than customers expect because the evidence sits in several systems and the money has often already moved. Botminds' Fraud Case Management is the software a bank's fraud team can use to run those steps.

The example on this page is from a fictional sample bank, Corvane National Bank, and its business customer Ridgeline Auto Body LLC; the people and figures are invented. The rules are real and linked.

Do banks actually investigate fraud, or just refund it?

They investigate, and for consumer accounts the law says how. Regulation E, which covers electronic transfers from personal accounts, makes a bank that receives a notice of error investigate it promptly and decide within 10 business days whether an error occurred; it may take longer only by crediting the account provisionally while it finishes (12 CFR 1005.11(c)(1)). The clock, day by day, is in our Reg E dispute timeline.

Investigating is not the same as refunding everything. The bank is deciding whether a transfer was unauthorized, which means someone other than you made it without your authority. The CFPB's compliance FAQs say that a transfer made with login details a fraudster tricked out of you counts as unauthorized. A payment you sent yourself after being deceived is a different question, and those FAQs do not say the same of it. That difference is why the investigator asks how the money left, not only whether you meant it to.

What happens after I report fraud to my bank?

Your report opens a case, and in a bank with good systems the case joins everything else the bank already knows. On the sample case, a business owner's digital banking was taken over early one morning: a password reset from a phone the bank had never seen, the mobile number changed, a check deposited by phone, a new payee added and a $48,600 wire sent to it, then a $9,800 debit from an unfamiliar company. The bank's systems raised four alerts across two days. In the solution they became one case, so one investigator worked the whole fraud instead of two people working pieces of it.

Then the investigator gathers the evidence, decides what happened, and works out what can be recovered. On the sample case the bank asked the receiving bank to return the wire and got $29,100 back; it returned the $9,800 debit in full. The counterfeit check could not be recovered. Of $61,200 lost, $38,900 came back and $22,300 was outstanding. A supervisor approved reimbursing that amount, and a letter was drafted to the owner. What the investigator's working day looks like from the inside is in a day in the life of a fraud analyst.

The numbers an investigator works out, and the letter that follows

How long does a bank take to investigate fraud?

For a consumer's unauthorized electronic transfer, 10 business days, or up to 45 days if the bank credits your account provisionally within those 10 days. Some cases get longer: 20 business days and 90 days apply when the transfer happened within 30 days of the first deposit to a new account, and 90 days applies to point-of-sale debit card transactions and transfers not initiated within a state. The bank must then report the results within three business days of finishing.

Inside those limits, banks set their own clocks. The sample bank's fraud team has 10 business days to decide a case, five when more than $25,000 is involved; the sample business case was decided six days after the last alert, a day inside its clock. These are the bank's settings, not the law, and no regulator publishes how long investigations actually take.

Will the bank tell me the result of a fraud investigation?

Yes, for a consumer claim. The bank must report the results to you, and if it decides there was no error, or a different error from the one you reported, its report must explain its findings in writing and tell you that you may ask for copies of the documents it relied on (12 CFR 1005.11(d)(1)). A denial that gives no reason, or no way to see the evidence, falls short of the rule.

There is one thing the bank will never tell you: whether it filed a suspicious activity report about the activity. That report goes to FinCEN, the Treasury's financial intelligence unit, and the law forbids the bank from disclosing it or anything that would reveal it (31 CFR 1020.320(e)). In the solution, the fraud case holds only a reference to any referral, and the letter to you is checked before it is sent so that nothing in it hints at one. How the bank's anti-money laundering team reaches its own decision is set out in AML investigation steps.

What a fraud case will never show, including in your letter

Do banks report fraud to the police?

Banks report suspicious activity to FinCEN, where it is available to law enforcement, rather than calling the police on every case. A SAR is required for fraud above set thresholds, such as $5,000 where a suspect can be identified or $25,000 regardless, and must be filed within 30 days of detection. For violations that need immediate attention, the SAR rule also requires the bank to notify law enforcement by telephone at once. You will not be told either way.

You can report it yourself, and the FBI asks you to. Its Internet Crime Complaint Center tells victims: "Regardless of the amount lost, file a complaint at www.ic3.gov." Its Recovery Asset Team works with banks to freeze money in flight. A bank cannot make a police report a condition of investigating your claim. The CFPB's FAQs answer that question with a plain no: the bank has to start work as soon as you tell it, by phone or in writing, and may not hold up starting or finishing the investigation while it waits for anything more from you.

Why reporting fast matters

Two reasons: the law limits your loss when you report quickly, and money is easiest to stop while it is still moving. If your card or other access device is lost or stolen and you tell the bank within two business days of learning of it, your liability for unauthorized transfers is capped at $50; after that the cap rises to $500, and for transfers on a statement you do not report within 60 days, you can lose protection for later transfers (12 CFR 1005.6).

The FBI's advice is blunt: "If you discover a fraudulent transfer, time is of the essence." It tells victims to contact their bank immediately and ask for a recall. On the sample case, the bank sent the wire recall the day after the fraud and recovered $29,100 of $48,600; the rest had moved on.

Can a bank close or freeze my account during a fraud investigation?

Often yes, under the account agreement, to stop further losses, but a freeze should be a person's decision, not a machine's. In 2022 the CFPB found that Bank of America acted unfairly when it froze prepaid card accounts and denied fraud claims based solely on an automated fraud filter, and that it had not investigated reasonably (CFPB order). In Fraud Case Management, no agent can freeze or unfreeze an account; one person proposes it and another approves.

If your account is frozen, ask the bank what it needs from you and when it expects to decide. For a consumer electronic transfer, the Regulation E clocks still run; a frozen account does not pause them.

What if it is a business account?

Then Regulation E does not apply, and the account agreement and other law decide. For wires, Article 4A of the Uniform Commercial Code generally lets a bank hold a business to an unauthorized payment order only if the bank's security procedure was commercially reasonable, agreed with the customer, and followed in good faith. The sample case was a business account. The bank's own standard required a 24-hour hold on new payees after a phone number change, and a software release had left that hold off the page where the number was changed. The investigator's memo said why the bank bore the outstanding loss, and the bank reimbursed $22,300.

Business owners should read their online banking agreement before they need it: it sets out the security procedures, the notice periods and who bears what. The steps a bank's fraud team follows inside, from alert to close, are set out in the fraud investigation process in banks.

Questions people ask

How do banks investigate fraud claims?

An investigator reviews your transactions, the records of logins and devices on your account, any images of checks, recordings of your calls and earlier cases, and decides whether the transfer was authorized. The CFPB says the investigation must be reasonable, including a review of relevant records in the bank's own files, and a second person usually approves any refund.

Can my bank ask me for a police report before investigating?

Not as a condition of starting or finishing a Regulation E investigation. The CFPB's FAQs say a bank must begin promptly and may not delay pending information from the consumer. You may still choose to report to police or to the FBI's IC3.

Will I get my money back if a scammer tricked me into sending it?

It depends on how the money left. A transfer someone else made with login details they tricked out of you is treated as unauthorized under the CFPB's FAQs; a payment you sent yourself after being deceived is not covered the same way, and banks' own policies vary.

What happens if the bank finds no fraud?

It must explain its findings in writing and tell you that you can request the documents it relied on. If it had given you a provisional credit, when it takes the credit back it must tell you the date and amount and honor certain checks and preauthorized payments for five business days after telling you.

Does the bank tell the fraudster's bank?

It usually contacts the receiving bank to request a recall or return of the money, which is how recovery happens; on the sample case that returned $29,100 of a $48,600 wire. Anything it reports to FinCEN stays confidential.