The Bank Says I Authorized the Transfer—but I Didn’t.

Published October 1, 2026 · Sources checked October 1, 2026

Being told “the transfer was authorized” can be confusing when someone else moved your money. A successful login, device record, or security code may explain how a payment happened. Whether the person initiating it had authority is a separate factual question that deserves an accurate account of events.

Who entered the payment instructions?

Begin with what you actually did. Did an intruder sign in and initiate the transfer? Did someone impersonating support obtain a code and then move the funds? Or did you personally enter the recipient and send the payment after a misleading call? These situations can raise different legal issues even when all involve deception.

The CFPB’s electronic-transfer FAQs explain that certain transfers initiated by a fraudster using credentials obtained through deception can qualify as unauthorized. That does not mean every payment connected with a scam is an unauthorized transfer. Coverage, authority, and whether you received a benefit still matter.

Describe shared access honestly

If you shared a password or code, include that fact and explain the circumstances. If you previously gave a family member permission to use the account, explain the scope of that permission and when you notified the institution it had ended. Actual authority can change the analysis; a person exceeding private instructions is not automatically treated like a stranger stealing credentials.

Consumer negligence alone does not permit greater liability than Regulation E allows. But that principle does not eliminate the need to establish what happened or to assess reporting dates. See the CFPB guidance on consumer liability and unauthorized transfers.

Which evidence can help explain an account takeover?

Alerts about new devices, contact-detail changes, or password resets.
Messages and call records showing the impersonation or deception.
The disputed transfer identifiers, dates, amounts, and recipients.
Evidence of when access was lost and restored.
Your original report and the bank’s explanation of its authorization finding.

Keep original records and distinguish your observations from assumptions. A location mismatch may be relevant, but it does not alone prove who initiated a payment. Do not circulate live codes, passwords, or complete account numbers in an initial inquiry.

Compare the bank’s reasoning with your chronology

For a covered Regulation E denial, request written findings and the documents relied on under § 1005.11. Identify the specific question the response leaves unanswered. For example, does it explain why the person using a newly enrolled device had authority, or merely state that the device passed authentication? An attorney can assess that reasoning alongside the complete record.

Frequently asked questions

Does sharing a code automatically defeat my claim?

No. It is a fact to disclose, not a substitute for analyzing who initiated the transfer, authority, and the applicable rules.

What if I personally sent the payment?

Say so accurately. It may require a different analysis from account takeover; do not describe a payment you initiated as one an intruder initiated.

Request a free case review

No attorney’s fees unless we win. Fee terms and responsibility for case expenses are addressed in your written engagement agreement.

Tell us the institution, amount disputed, first-report date, and how it responded.

Request a free case review →Call (312) 598-5962