Security Scams that go straight for your money
How long does a bank have to investigate a fraud claim?
US banks get 10 business days, then 45 or 90 with your money back meanwhile. Credit cards, the UK's next day refund and 35 day scam limit, Australia and Canada.
The short answer
- In the US a bank has 10 business days to investigate a debit card or bank transfer fraud claim, or it must provisionally credit your account and then finish within 45 days, or 90 for point of sale, foreign and new account transactions.
- The 10, 45 and 90 day figures are all from Regulation E and are not competing answers: 10 business days is the first deadline, 45 or 90 days the last.
- A credit card issuer must resolve a billing error within two complete billing cycles and no later than 90 days, and cannot collect the disputed amount meanwhile.
- In the UK an unauthorized payment should be refunded by the end of the next business day, and a scam transfer reimbursed within 5 business days, or 35 if the bank stops the clock.
- Australia's ePayments Code allows 21 days for an outcome or a written notice and 45 days in total; Canada's debit card code allows 10 business days.
- This is general information rather than legal or financial advice for your situation.
In the US, a bank has 10 business days to investigate a fraud claim on a debit card or bank transfer. If it needs longer, it must put the money back as a provisional credit by that tenth business day, then finish within 45 days, or 90 for debit card purchases in a shop, foreign transactions and accounts under 30 days old. A credit card issuer has two billing cycles, never more than 90 days. In the UK an unauthorized payment should be refunded by the end of the next business day, and a scam transfer you were tricked into making within five business days, or 35 at the outside.
The deadlines side by side
The clocks below come from US regulations, UK regulators and the Australian and Canadian codes. Read the last column first: where your money sits meanwhile matters more than how long it takes.
| Rule | What it covers | First deadline | Final deadline | Your money meanwhile |
|---|---|---|---|---|
| US, Regulation E | Debit card, ATM, online banking or other electronic transfer | 10 business days to decide | 45 days, if it gives provisional credit by day 10 | Provisionally credited, less at most $50 |
| US, Regulation E | Debit card purchase at a point of sale, or a transfer not initiated in the US | 10 business days | 90 days | Provisionally credited from day 10 |
| US, Regulation E | Transfer within 30 days of the account's first deposit | 20 business days | 90 days | Provisionally credited from day 20 |
| US, Regulation Z | Credit card billing error, including unauthorized charges | Written acknowledgment within 30 days | 2 complete billing cycles, 90 days at most | You need not pay the disputed amount, and it cannot be reported as delinquent |
| UK, unauthorized payment | A payment you did not make | Refund by the end of the next business day | None stated; the refund comes first | Refunded, with charges and lost interest |
| UK, APP scam reimbursement | A Faster Payments or CHAPS transfer you were tricked into making | 5 business days | 35 business days if the bank stops the clock | Nothing until the bank decides |
| Australia, ePayments Code | Unauthorized electronic transaction | 21 days for an outcome, or a written notice that it needs longer | 45 days unless there are exceptional circumstances | Depends on the bank's terms |
| Canada, Debit Card Code | Unauthorized debit card transaction | A response within 10 business days | Paused while the bank waits for your signed statement | Depends on the bank's terms |
US rules give the bank time but make it return the money while it uses it. The UK refunds first and investigates afterwards. A scam payment you made yourself is the one case where you wait without the money.
Why 10 days, 45 days and 90 days all get quoted
All three come from one rule, 12 CFR 1005.11 in Regulation E, and each is right for a different stage. By the 10th business day the bank must either have decided or have put the disputed amount back in your account. The 45 days is the outer limit for finishing, and only a bank that gave that provisional credit gets it. The 90 days replaces the 45 for debit card purchases at a point of sale, transfers not initiated within a state (in practice, foreign ones) and anything within 30 days of the account's first deposit. For new accounts the first deadline also stretches to 20 business days.
A fourth number, 60 days, is yours, not the bank's: the time you have to report an error after the statement showing it is sent, explained in how long you have to report fraud to your bank.
So "the bank has ten days" and "it can take three months" are both correct. Report a stolen debit card used in a store, and by the tenth business day, about two weeks later, the bank either confirms the fraud or credits the money back; it can then investigate for up to 90 days while the money sits in your account. The 10 and 20 are business days; the 45 and 90 are plain days from your notice.
The provisional credit can be up to $50 short: if the bank reasonably believes an unauthorized transfer happened and has met the conditions in 1005.6(a), it may withhold a maximum of $50. It must tell you about the credit within two business days of making it.
What the bank owes you when it decides
Under Regulation E the bank must report its findings within three business days of finishing, and correct an error within one business day of finding it. If it finds no error, it owes you a written explanation and must tell you that you can ask for the documents it relied on, which the Consumer Financial Protection Bureau says it must then send promptly.
A refusal does not make the provisional credit vanish overnight. The bank must tell you the date and amount it will take back, and keep honoring your checks and similar payments for five business days after that notice. Use those days to move money in so nothing bounces.
Once the bank has complied, repeating the same claim does not restart the process. If you disagree, complain to the bank and then the regulator, with a report to the right outside body alongside it.
Credit cards: two billing cycles and no collection
Credit cards follow Regulation Z, 12 CFR 1026.13, and count in billing cycles. Once the issuer receives your written billing error notice, it must acknowledge it in writing within 30 days, and resolve it "within 2 complete billing cycles (but in no event later than 90 days)".
No provisional credit is needed: while the dispute is open you need not pay the disputed amount, and the issuer may not collect it or report it as delinquent. If it finds no error, it must tell you in writing what you owe and allow the usual time to pay. For charges you did make but want to contest, the route is a merchant dispute, covered in disputing a payment and chargebacks.
The UK: a refund first, then the questions
For a payment you did not authorize, the Financial Conduct Authority says "the refund should be in your account by the end of the next business day", along with any charges and interest you paid or credit interest you lost. The bank may ask you to fill in a form, but this "shouldn't delay your refund". It can refuse if you authorized the payment, acted fraudulently, or failed to protect your card details, PIN or password.
A transfer you made because a scammer deceived you is a separate claim. Since 7 October 2024, Faster Payments and CHAPS transfers have been covered by mandatory reimbursement, and the Payment Systems Regulator says to expect it within five business days. The bank may stop the clock to gather information, but must reach an outcome within 35 business days. In the first quarter of 2026 the regulator's dashboard recorded 82% of claims resolved within five days and 98% within 35 business days. If a caller talked you into moving money to keep it safe, that was the safe account scam, and the first hour after sending money to a scammer sets out what to say when you call.
If the bank refuses or runs late, complain in writing. The Financial Ombudsman Service gives most businesses up to 8 weeks to answer a complaint, but only 15 days for fraud, scams and payment services. Then you can go to the ombudsman, within 6 months of the final response.
Australia and Canada: 21 days and 10 business days
Australia. The ePayments Code, a voluntary code administered by ASIC, gives a subscribing bank 21 days from your report of an unauthorized transaction to tell you the outcome in writing, or that it needs more time. It must finish within 45 days unless there are exceptional circumstances, such as delays caused by other institutions or foreign merchants. In a 2024 lawsuit ASIC alleged that HSBC Australia took on average 145 days to investigate customers' reports that they had been scammed, across about 950 reports between January 2020 and August 2024.
Canada. The Canadian Code of Practice for Consumer Debit Card Services, also voluntary, says the card issuer will respond to a report of an unauthorized transaction as soon as possible and no later than 10 business days. If it asks you for a signed statement or affidavit, the 10 days can be suspended until it receives it.
Where these clocks stop
This is general information, not legal or financial advice. Regulation E protects consumer accounts; a business account depends on its contract. The UK scam scheme covers only Faster Payments and CHAPS transfers, not card payments. A voluntary code binds only the banks that signed it.
How to keep your claim on the fast clock
- Report by phone, then in writing the same day. Use the number on your card, because caller ID can be faked. Every clock above starts when the bank receives your notice.
- Send whatever the bank asks for at once. A missing confirmation or affidavit is what pauses or forfeits the faster deadline.
- Put day 10 in your calendar. No decision and no provisional credit by then means asking why, in writing.
- Close the hole. Change your banking password and turn on the alerts that make fraud hard, and if the thief had your personal details, watch for the early signs of identity theft.
Common questions
Does the bank have to give me my money back while it investigates?
In the US, for debit cards and bank transfers, yes, if the investigation runs past 10 business days (20 for a new account). The bank must provisionally credit the disputed amount, less at most $50, and tell you within two business days. The exception is a phone report the bank asked you to confirm in writing, where the confirmation never arrived within 10 business days.
Can a bank take back a provisional credit?
Yes, if it decides there was no error. It must first tell you the date and amount it will debit, then keep honoring checks and similar payments for five business days after that notice, as far as they would have been paid with the credit in place. It must also explain its findings in writing and send the documents it relied on if you ask.
Why is my fraud claim taking 90 days?
Because the transaction is in one of the groups Regulation E allows longer for: a debit card purchase at a point of sale, a transfer not initiated in the US, or a transfer within 30 days of the account's first deposit. The bank can take up to 90 days, but it still has to give you provisional credit by the first deadline.
How long does a credit card fraud investigation take?
At most two complete billing cycles, and never more than 90 days, once the issuer receives your written billing error notice. It must acknowledge that notice within 30 days. In the meantime you do not have to pay the disputed amount, and the issuer cannot report it as late or try to collect it.
What can I do if my bank misses the deadline?
Complain in writing, quoting the rule and the date you reported. In the UK, a fraud or payment complaint can go to the Financial Ombudsman Service once 15 days pass without a final response. In Australia, the ePayments Code tells subscribers to say when you can go to the external scheme.