Countervail Intelligence

Threat Insights

When the Bank Says No: Institutional Culpability in Fraud Cases

Flat illustration of a closed bank teller window with an amber padlock and a document passing beneath it, in navy, charcoal and teal tones

A denial is the first answer

When a fraud department says the money is gone, that statement is a position, and you can challenge it. Banks and credit unions work under deadlines and duties after every fraud report. A denial that skips them invites a challenge.

Patco Construction, a small Maine business, shows how this plays out. In May 2009, criminals used stolen online banking logins to send six withdrawals totaling $588,851.26. The bank blocked or recovered $243,406.83 and left Patco with a $345,444.43 loss. The bank’s position: the right login was used, so the loss belonged to Patco.

In 2012 a federal appeals court looked at the bank’s security as a whole and found it “commercially unreasonable.” The lesson helps anyone. When a bank says “you authorized it,” the next question is whether the bank did its own job.

Security as an insurance policy

In my experience, institutions run cybersecurity the way they hold insurance: a cost paid to show coverage after something goes wrong. They pick controls that meet the minimum rules, document them well, and leave them alone until the next exam.

Patco shows what the minimum looks like. The bank lowered the point where it asked security questions from $100,000 to $1. Every login got the same questions, and a keylogger (software that records what you type) captured the answers. The criminals’ transactions scored 563 to 790 on the bank’s own risk scale, against a normal 10 to 214 for that customer. Nobody reviewed the warnings and nobody called the customer. Other banks at the time used text codes or hardware tokens. The court asked for commercially reasonable security, short of the best system available, and found the whole system fell short.

Individuals face the same pattern. In December 2024 the Consumer Financial Protection Bureau (CFPB) sued Zelle’s operator and three large banks, alleging that fraud was allowed to “fester” and that customers lost about $870 million over seven years. The CFPB dropped the case with prejudice on March 4, 2025, so a court never ruled on the allegations.

A security control on paper leaves open whether it worked against a known attack. That question decides many disputes.

Which rules protect you

Your protections depend on whose account it was and how the money left.

Your situationMain ruleWhat it means for you
Personal debit card, bank transfer or payment appElectronic Fund Transfer Act and Regulation E (federal)Deadlines for the bank, a cap on what you can lose, and a bank that must prove you authorized the transfer.
Credit cardTruth in Lending Act (federal)You can lose $50 at most, and the card issuer must prove the charge was authorized.
Business account (wires, ACH, online banking)Uniform Commercial Code Article 4A, state law and your bank agreementRegulation E covers personal accounts only. A business account depends on the bank using security that is commercially reasonable for your business. Patco made that argument and won the point on appeal.

Individuals: the Regulation E clock

  • 2 business days. Report within 2 business days of learning about the fraud and you lose $50 at most. After that, up to $500.
  • 60 days. Report within 60 days of the statement that shows the transfer. Waiting longer can cost you transfers made after that date.
  • 10 business days. The bank must finish investigating or give you a temporary refund (called provisional credit) while it keeps going.
  • 45 days. The most the bank gets to finish if it gave you the temporary refund.
  • 3 business days. After finishing, the bank must tell you the result. A denial must come with a written explanation, and you can request the documents the bank relied on.
  • The bank carries the burden. It must prove the transfer was authorized.

When a bank breaks these rules, you can sue. A court can award your actual losses, $100 to $1,000 in additional damages, and your attorney’s fees. When the bank skipped a good-faith investigation or ignored the evidence in front of it, a court can award up to three times your losses. You have one year to sue.

Businesses: commercially reasonable security

Your bank must protect your account with security that fits your business: your size, your usual payments and the kind of transfers you make. Warning signs the bank ignored, such as an unusual amount, a new payee or a login from a strange location, count in your favor. Tell the bank the day you see the problem, because delay weakens a claim, and check your account agreement for reporting deadlines.

State law: Washington and California

State law adds remedies that federal law lacks. Most states have similar consumer protection and data breach laws.

LawWhat it does for you
Washington Consumer Protection Act, RCW 19.86Bans unfair or deceptive business practices. If you were injured in your business or property, you can sue for your losses. A court can add up to triple damages (capped at $25,000) plus attorney’s fees.
Washington data breach law, RCW 19.255.010Companies must tell affected residents within 30 days of discovering a breach, and the Attorney General within 30 days when more than 500 residents are affected.
California Consumer Privacy Act, Civil Code 1798.150When weak security lets your personal data be stolen, you can recover $100 to $750 per incident, or your actual damages if higher. You send 30 days’ written notice first, which gives the company a chance to fix the problem.
California Consumer Financial Protection Law, Financial Code 90003Bans unfair, deceptive or abusive practices in consumer financial products. The Department of Financial Protection and Innovation (DFPI) enforces it and takes complaints.
California Unfair Competition Law, Business and Professions Code 17200Bans unlawful, unfair or fraudulent business practices. Lawyers often add it to other claims.

One incident can trigger several of these at once: the federal clock, a state claim and a breach notice.

Security rules financial institutions must follow

Financial companies also follow security and reporting rules whether or not a victim complains.

  • Security programs. Banks must keep a written, board-approved program covering risk assessment, access controls, monitoring, staff training, testing, vendor oversight and multi-factor login (the Interagency Guidelines and FFIEC guidance). Non-bank financial companies follow the FTC Safeguards Rule, which adds encryption and a written incident response plan.
  • Incident reporting. Banks must notify their federal regulator within 36 hours of a serious computer-security incident, and bank service providers must alert their bank customers.
  • ACH fraud monitoring. Nacha rules phased in during 2026 require banks and payment senders to run risk-based checks for suspicious ACH payments, including vendor and payroll impersonation. The rules on who absorbs a loss stay the same.
  • Vendor oversight. Banks stay responsible for security at the vendors they hire (interagency guidance, June 2023).

Regulators enforce these rules, and the Gramm-Leach-Bliley Act gives individuals no right to sue under it. For a victim, the rules show what a reasonable program includes and give a regulator complaint something specific to cite.

SOC 2: what it proves

SOC 2 is a voluntary audit report, and no law requires it. An independent CPA firm tests a company’s controls against five criteria. Security is always included, and the other four (availability, processing integrity, confidentiality, privacy) are optional. A Type 1 report checks the design of controls on one date. A Type 2 report checks whether they worked over a period, typically six to twelve months. The company picks the scope, and the report can list exceptions where controls fell short.

A clean report shows an auditor tested certain controls in a certain scope during a certain window. It leaves open whether those controls covered the channel the criminal used or ran on your account. Ask for the scope, the period, the exceptions and the controls tied to your transfer.

The limits of a missed rule

A missed rule opens specific remedies, and recovery depends on the facts. Three limits shape every claim.

Scams where you sent the money. Regulation E’s commentary treats a transfer by someone who got your account access through fraud or robbery as unauthorized. In Green v. Capital One (S.D.N.Y. 2021), a customer who gave account details to a fake support line stated a valid claim. Many banks treat a payment you knowingly sent, such as a Zelle transfer to a scammer posing as your bank, as authorized. Courts and regulators have left that line unsettled.

Deadlines. The 60-day reporting window and the one-year deadline to sue can end a strong claim.

Defenses. A bank can excuse an honest mistake made despite reasonable procedures, and can avoid liability by correcting the account and paying actual damages before you sue.

A denial leaves the road open. Responsibility shifts toward the institution with each legal duty it missed, and recovery follows the remedies the law defines.

What to do today

Speed matters most. Know your rights before the call with the fraud department.

Red flags in a denial

  • The bank requires a police report, affidavit or branch visit before it investigates.
  • Business day 10 arrives and your account shows no temporary refund.
  • The denial says “you authorized it” and omits what the bank reviewed.
  • The written explanation arrives later than 3 business days after the decision, or never.
  • The caller sends you to the merchant, the app or the scammer.

Steps

  • Report right away, by phone and in writing. Name the account, date, amount and why the transfer is unauthorized, and keep a copy. Individuals: use the words “notice of error under Regulation E.” Businesses: ask the bank to recall the payment from the receiving bank immediately.
  • Write down every deadline. Business day 10, day 45 and the 60-day reporting window from the statement date.
  • Request the written explanation and the documents the bank relied on. Businesses: also ask for the bank’s security and risk-score records for the transaction, and save your own login records, device logs and emails.
  • Dispute credit card charges in writing. Your loss is capped at $50, and the issuer must prove authorization.
  • File reports. ReportFraud.ftc.gov and ic3.gov create a record. A police report strengthens the file, and the bank’s duty to investigate starts without it.
  • Escalate in writing. Complain to the bank’s primary regulator (OCC, Federal Reserve, FDIC or NCUA), the CFPB, and your state attorney general or financial regulator. In Washington, that includes the Attorney General’s Consumer Protection Division and the Department of Financial Institutions. In California, it includes the DFPI.
  • Cite the rules in every complaint. Name Regulation E (or your business account’s security duties), your state consumer protection law and the institution’s security obligations.
  • Line up a lawyer before the one-year deadline. A consumer-protection lawyer fits personal accounts, and a commercial litigator fits business accounts. Fee-shifting makes some claims workable for a lawyer to take.
  • If money moved to a gift card or crypto, call that company right away, then tell someone you trust.

A denial from a fraud department closes that conversation. The legal question stays open.

Sources

·