Ilia Nikolaevich Zavialov on fraud and authorized bank transfers: reimbursement rules, what they cover and checks before you pay

Overview / Blog

Published: October 1, 2026 · 11 min read · Ilia Nikolaevich Zavialov

1. Authorized or unauthorised: the word that decides who pays

   When money leaves an account because a criminal stole a card or logged in without permission, the payment is unauthorised, and in most countries the bank carries most of that loss. When the account holder pressed the button themselves because a fraudster talked them into it, the payment is authorized, and the answer to who pays becomes much less certain.

   That second kind of fraud now dominates. Fraudsters have learned that it is easier to persuade a person to send money than to break into a bank, so they invest in stories: a parcel that needs a fee, an investment with steady returns, a call from the bank's security team, an invoice with new bank details.

   Ilia Nikolaevich Zavialov explains how reimbursement works when the payment was authorized under deception, what the rules in each country cover and what a payer can check before the money goes. For a due diligence site the second half matters as much as the first: most refund disputes are lost or won at the moment of payment.

2. How people are talked into authorising a payment

   Purchase scams are the most common form. A person pays for goods, a car, a rental or tickets that do not exist, usually by bank transfer to a seller found online. Investment scams take larger sums over longer periods, starting with a small deposit and a convincing dashboard that shows growth.

   Impersonation scams use authority. A caller claims to be from the bank, the police or a tax office and asks the victim to move money to a safe account, sometimes guiding them through each screen of the banking app. Invoice and payee redirection scams target businesses and people buying property, replacing the real bank details in a genuine conversation.

   Romance scams build a relationship first and ask for money later, often for an emergency, a ticket or a business opportunity. In every version the payment looks normal to the bank: the customer logged in, entered the details and confirmed the transfer.

3. Why banks treat these payments differently

   A bank can block a stolen card or reverse a login it did not expect. It cannot easily tell whether a customer who confirmed a payment did so freely or under pressure. For years that was the main argument for leaving authorized push payment losses with the customer.

   That argument has weakened. Banks now see patterns that a single customer cannot: new payees, unusual amounts, accounts that receive many payments and empty them within hours. Regulators in several countries have concluded that the institutions that see these patterns should share the cost when they fail to act.

   The result is a patchwork. One country makes reimbursement mandatory with a cap, another makes the bank liable only when it ignored a specific warning sign, a third leaves the matter to voluntary policies and the courts. Knowing which regime applies is the first step in any claim.

4. What a bank looks at when you ask for a refund

   The first question is timing. A fraud reported within minutes or hours gives the bank a chance to contact the receiving bank before the money is moved on, and some or all of it can be frozen. A report made weeks later leaves only the formal reimbursement process.

   The second question is what the customer was told. If the banking app showed a clear warning about this type of scam and the customer went ahead, the bank may argue that the customer did not take enough care. If the bank showed nothing, or the warning was generic, that argument is weaker.

   The third question is the evidence. Messages, call logs, the advert or website, payment confirmations and the story in the customer's own words help the bank understand what happened. A claim supported by a clear timeline is handled faster than one that has to be reconstructed by phone.

5. The first hour after a scam payment

   Call your bank on the number printed on your card or shown in the official app, say that you made a payment because of a scam and give the time, amount and recipient details. Ask the bank to contact the receiving bank immediately. Do not wait for the fraudster to answer a final message.

   Stop any further payments to the same person, whatever reason they give, and change the passwords of online banking and email if you shared codes or installed software at their request. If a caller guided you through the app, assume they may try again with a new story.

   Write down what happened while it is fresh, take screenshots of every message and the profile or website, and report the fraud to the police or the national fraud reporting service. The reference number is useful for the bank, and the record helps link your case to others.

6. What US federal law covers

   In the United States the main protection for electronic transfers is Regulation E, and it covers unauthorised transfers, those started by someone other than the account holder without authority. A transfer that the customer made personally after being deceived does not fit that definition, so there is no federal rule that obliges a bank to refund it.

   For transfers that are unauthorised, the customer's liability is capped at 50 dollars if the bank is told within 2 business days, and at 500 dollars after that, while a transfer that appears on a statement should be reported within 60 days. The Consumer Financial Protection Bureau takes the view that a transfer is unauthorised when a fraudster tricked the customer into sharing login details and then made the transfer personally.

   The difference matters in practice. If a caller persuaded you to read out a code and then moved the money, describe exactly that to your bank, because it may fall under Regulation E. If you pressed send yourself, your claim rests on the bank's own policies and on how quickly you reported it.

7. Zelle, the CFPB case and voluntary refunds

   On 20 December 2024 the Consumer Financial Protection Bureau sued the operator of Zelle and three large banks, citing customer complaints about fraud on Zelle worth more than 290 million dollars at Bank of America, more than 360 million at Chase and more than 220 million at Wells Fargo. On 4 March 2025 the bureau voluntarily dismissed the case, and the court closed it the next day.

   Zelle requires participating banks to reimburse some qualifying imposter scams even where the customer authorized the payment. According to the bureau's complaint, this covers only a fraction of the fraud on the network, and a Zelle payment to an enrolled recipient cannot be reversed once sent.

8. What the US numbers show

   Consumers filed 3 million fraud reports with the Federal Trade Commission in 2025 and reported losses of 15.9 billion dollars. Bank payments produced the highest total losses of any payment method, followed by cryptocurrency. In 2024 losses through bank transfers and payments reached 2.09 billion dollars, more than any other method.

   Speed changes the outcome. In 2025 the FBI's Recovery Asset Team opened 3,900 Financial Fraud Kill Chain cases covering attempted thefts of 1,163,919,846 dollars and froze 679,013,183 dollars, a success rate of 58 percent. Money can be frozen only while it is still moving, which is why the first report matters so much.

9. Checks before you pay a new payee

   Most avoidable losses happen with a first payment to someone new. Before that payment, check that the name on the account matches the person or company you expect. Many banks now show a name check result before the transfer, and a mismatch or partial match deserves a pause before you go on.

   For a business, look it up in the official company register, compare the registered name and address with the invoice and check how long it has existed. For an individual seller, ask why the payment cannot go through the platform where the item is listed. Platforms have dispute processes that a direct transfer does not.

   Confirm any change of bank details by calling a number you already had before the change, never a number from the message that announced it. A request to keep the payment confidential, to hurry, or to split it into several smaller transfers is a reason to stop.

   For regular payments it helps to keep your own list of verified payees whose details were confirmed by phone. A new payee or a change to that list then becomes a separate event that is checked again from the start, as if it were the first payment.

10. Businesses, charities and changed bank details

    Organizations lose money to authorized push payment fraud through the same door again and again: a genuine supplier, a genuine conversation and a message saying the bank details have changed. The fraudster may have access to the supplier's mailbox or may have registered a lookalike address.

    Two habits stop most of these losses. Any change of a supplier's bank details is confirmed by phone to a number from the existing contract or records, and payments above a set amount need a second person to approve them. These rules are cheap and work regardless of the country's reimbursement regime.

    Small businesses and charities should also check whether reimbursement rules in their country cover them. In some places protection extends to micro enterprises and charities, in others it covers consumers only, and a company that assumes it is covered may discover the opposite after the loss.

11. Where to go in the US

    Call your bank or credit union immediately and ask it to reverse the payment and contact the receiving bank. Then file a complaint at ic3.gov whatever the amount, because the FBI uses these reports to start the freezing process.

    If the bank refuses to help with an unauthorised transfer or does not investigate, file a complaint with the Consumer Financial Protection Bureau. Report the scam itself to the FTC at ReportFraud.ftc.gov. For a purchase made by credit card, a dispute under the Fair Credit Billing Act must reach the issuer within 60 days of the first bill showing the charge.

12. Recovery offers after a loss

    People who reported a scam online or joined a victims' group are often contacted by firms that promise to recover the money for a fee. Some claim to be lawyers, some claim to work with the police or a regulator, and some pretend to be the regulator itself.

    A real reimbursement claim goes through your bank, and after that through the ombudsman or the courts where they exist. None of these channels asks for an upfront fee, a tax, or access to your device to process a refund.

    If a recovery offer arrives, check the firm in the official register, call the regulator on the number from its own website and do not pay anything until you have done both. The second loss is often larger than the first, because the victim is desperate to get the first one back.