Regulation E: the error-resolution clock and unauthorized transfers

The legal question comes before the fraud label

Regulation E implements the Electronic Fund Transfer Act for covered consumer electronic transfers. Its current error-resolution and unauthorized-transfer provisions remain operative law; this article is a September 27, 2026 review of those provisions, not an announcement of a new rule. Section 1005.11 governs the investigation process, while section 1005.6 governs how much unauthorized-transfer loss may be allocated to a consumer. Treating those as a single chargeback policy produces mistakes. [1][2]

The CFPB's published EFT FAQs explain that a fraudster's use of stolen credentials can be an unauthorized transfer, including credentials obtained by tricking the consumer. Authentication establishes that a credential worked; it does not by itself establish actual authority. A payment the consumer personally initiates after deception presents a different fact pattern and must be assessed on its facts. Avoid a blanket rule that every scam is covered or that every correctly authenticated transfer is excluded. [3]

The operating clock

For an ordinary covered account, timely oral or written error notice generally triggers a prompt investigation and a determination within ten business days. If the institution needs the longer investigation period, provisional credit generally enables up to 45 calendar days. Specific new-account, foreign-transfer and point-of-sale provisions can change those periods. Written confirmation may affect provisional-credit eligibility in specified circumstances, but waiting for a signed affidavit does not pause the duty to investigate. [1]

Operationally, the intake record should contain the first qualifying notice, statement date, transfer channel, account-opening facts, claimed amount and applicable clock. A customer may describe an unfamiliar debit without knowing its network or legal classification. Staff should translate that description into the correct workflow rather than demand legal terminology. Routing through a fintech, branch, call center or fraud team must preserve the original notice and the evidence needed to calculate deadlines.

The 60-day statement-notice rule and the liability rules are different tests. A late notice under section 1005.11 does not automatically make every earlier unauthorized transfer the consumer's responsibility. Section 1005.6 includes separate notice and causation conditions, including circumstances involving a lost or stolen access device. Apply the actual provisions rather than treating 60 days as a universal reimbursement cutoff. [2]

Investigate the transaction, not just the password

Recommended evidence includes device enrollment, credential resets, beneficiary changes, session chronology, customer contact, transaction history and relevant service-provider records. A familiar IP address may be informative but is not dispositive. Remote access, shared devices and account takeover can produce superficially normal authentication evidence. Likewise, a new device is a reason to investigate, not proof that the claim is valid.

Separate the investigator's conclusion from the recovery team's success. Network deadlines, merchant responses and funds recovered from another institution can affect economics without replacing the consumer-law analysis. A denied recovery request is not sufficient evidence that the consumer authorized the payment. A recovered transfer also does not excuse a missed provisional-credit deadline or inaccurate closure notice.

Recommended quality review should sample both approvals and denials. Looking only at paid claims misses unsupported denials; looking only at losses misses systemic intake failures. Reconstruct the decision using the information available at the time and verify that later evidence was not silently substituted into the original record. Track overturned denials and repeat complaints by investigator, partner and transfer type.

Worked example: provisional credit is not final loss

Hypothetical example: a consumer timely disputes a $900 electronic debit from an established account. Assume the ordinary ten-business-day and 45-calendar-day framework applies, all notice conditions are satisfied, and no provisional-credit exception applies. The bank needs more investigation time and credits the full $900 by the applicable deadline. It has restored access while the investigation continues; it has not necessarily concluded that the claim is valid.

If the bank later determines an error occurred, its correction must address applicable interest and resulting fees, not only the face amount. If it determines no error occurred, the written explanation, evidence-access and provisional-credit reversal procedures matter. A same-day automated reversal without the required protections is not made compliant by a correct underlying determination. The example deliberately does not calculate an assumed consumer-liability amount; that requires the separate section 1005.6 facts. [1][2]

For capacity planning, suppose 1,000 disputes require 25 minutes each. That is approximately 417 investigation hours before supervision, customer follow-up and quality review. A ten-minute reduction saves about 167 hours, but only if it preserves necessary evidence and decision quality. These are staffing assumptions, not an observed bank performance claim.

Tradeoffs, controls and evidence that would change the assessment

Early credit can increase temporary cash exposure and invite opportunistic claims. Excessive friction can deny access to legitimate customers and create repeat contacts. The practical response is differentiated investigation, reliable deadline automation and targeted quality testing. It is not a presumption that consumers are always right or that authentication systems are infallible.

Useful management measures include deadline compliance, time to usable credit, evidence completeness, denial reversals, complaint recurrence and loss net of recoveries. Keep business-day calculations and holiday calendars testable. Measure outcomes by channel and provider because an aggregate average can hide a partner whose cases routinely arrive too late.

The strongest evidence of an effective program is a reproducible file showing timely intake, the correct legal pathway, a reasoned conclusion and completed customer remediation. A final court decision, amended regulation or agency interpretation directly addressing a contested transfer pattern could change the legal analysis. Better transaction evidence can change an individual decision. Neither a vendor's fraud score nor a network label independently resolves the legal question.

The legal question comes before the fraud label

The operating clock

Investigate the transaction, not just the password

Worked example: provisional credit is not final loss

Tradeoffs, controls and evidence that would change the assessment

Sources