Checklist · Banking

Disputing an Unauthorized Transfer and Recovering a Misdirected Payment: A Practical Checklist

15 U.S.C. § 1693

Type
Checklist
Jurisdiction
National
Date
2026-04-24
Topic
Banking

This checklist sequences a live payment fraud dispute from the first hour through final resolution. It begins with the classification step that determines which body of law applies, then walks through immediate containment: notice to the sending institution, provisional credit demands, recall and freeze requests, and criminal reporting. Separate sections handle each rail — cards, consumer electronic transfers, wires, checks, and instant payments — with the specific deadlines and language that trigger statutory duties. Later sections cover evidence preservation, the claim against the institution, insurance notice, and the prevention controls that should be implemented before the file is closed.

Disputing an Unauthorized Transfer and Recovering a Misdirected Payment: A Practical Checklist

Banking > Payments, Unauthorized Transfers, and Payment Fraud | Published 24 April 2026 - Updated 15 July 2026 | UpLaw - uplaw.us

Step one: classify before you act

☐ Identify the rail. Credit card, debit card, ACH debit, ACH credit, wire, check, instant payment, or a peer-to-peer app sitting on one of those. Everything downstream depends on this answer, so confirm it from the statement or transaction record rather than from the client's description. ☐ Identify the account type. Consumer asset account, consumer credit account, or business account. Consumer protections under 15 U.S.C. § 1693 and 12 C.F.R. Part 1005 do not reach business accounts at all. ☐ Determine who pressed send. If the account holder initiated the transfer after being deceived, it is an authorized transfer and the error resolution machinery does not apply to it directly. Say this to the client early rather than late. ☐ Fix the date of the statement showing the first affected transaction, because the sixty-day clock in 15 U.S.C. § 1693f runs from it. ☐ List every affected account and every transaction with date, amount, channel, and counterparty, in one table. ☐ Determine whether funds have left the receiving institution, because that single fact determines whether recovery is realistic.

The first hour

☐ Call the sending institution's fraud line and get a case number, the representative's name, and the time. ☐ Follow with written notice the same day. Use the words "unauthorized transfer" and "error" where they are accurate, because those words trigger statutory obligations. ☐ For a wire, request a recall immediately and ask for the outgoing recall message reference number. ☐ For a card, request a chargeback and note the reason code. ☐ For an ACH debit, request a return and cite the unauthorized entry rules. ☐ Ask the sending institution to contact the receiving institution directly — bank-to-bank requests move faster than customer requests. ☐ Call the receiving institution if identifiable and request a freeze pending a fraud investigation; offer to provide an affidavit and police report immediately. ☐ Change every credential on affected and linked accounts, and check for mail forwarding rules, added recipients, changed contact details, and phone number porting. ☐ Preserve the device if a compromise is suspected; do not wipe or reset it.

The first day

☐ File a police report and obtain the report number. ☐ File the federal fraud complaint through the channel able to trigger a rapid freeze on fraudulent wires, and do it within hours rather than days. ☐ Send preservation letters to every institution in the chain requesting retention of transaction logs, authentication records, call recordings, fraud model alerts, and the dispute file. ☐ Collect evidence — emails with full headers, text messages, call logs, screenshots with visible timestamps, app notification history, and account statements. ☐ Notify insurers under crime, cyber, and professional liability policies; notice provisions are often measured in days. ☐ Notify affected counterparties — a vendor whose invoice was hijacked, a client whose closing funds were diverted — before they learn it elsewhere. ☐ Calendar every deadline: sixty days from statement, chargeback windows, policy notice deadlines, and the limitations period.

Consumer electronic transfers

☐ Give notice within sixty days of the statement; oral notice starts the clock, written notice preserves the record. ☐ State the transactions in dispute, the amount, and why the consumer believes an error occurred, which is what 15 U.S.C. § 1693f requires. ☐ Demand provisional credit within ten business days if the investigation will take longer, and put the deadline in the letter. ☐ Track the investigation deadline — ten business days, extendable to forty-five, or ninety for new accounts, point-of-sale, and foreign-initiated transfers. ☐ Request the documents relied on if the institution finds no error; it must provide them. ☐ Check the liability tier under 15 U.S.C. § 1693g: two business days for a $50 cap, sixty days from the statement for a $500 cap, and unlimited exposure after that. ☐ Assert extenuating circumstances — hospitalization, extended travel — where they apply. ☐ Preserve the stop payment record if a preauthorized transfer was involved under 15 U.S.C. § 1693e. ☐ Document every institutional failure — a missed provisional credit, a determination without a written explanation, a refusal to produce documents — because these are the claims with statutory damages under 15 U.S.C. § 1693m.

Cards

☐ Dispute in writing within sixty days of the statement under 15 U.S.C. § 1666, and separately file the network chargeback. ☐ Confirm the issuer acknowledges within thirty days and resolves within two billing cycles. ☐ Confirm no collection activity or adverse credit reporting occurs while the dispute is pending, and document any that does. ☐ Consider claims and defenses under 15 U.S.C. § 1666i where the dispute concerns goods or services, and document the good-faith attempt to resolve with the merchant. ☐ Check the unauthorized use cap at 15 U.S.C. § 1643, remembering that network rules usually provide zero liability. ☐ Keep the merchant correspondence, because representment will turn on it.

Wires

☐ Request the recall within the hour and record the message reference; a recall is a request, not a right. ☐ Obtain the payment order as transmitted, including the beneficiary name and account number, to evaluate the misdescription issue. ☐ Obtain the account agreement in force and the agreed security procedure. ☐ Determine whether the institution actually followed the procedure — a callback that was skipped, a dual approval that was bypassed, a threshold that was ignored. ☐ Evaluate commercial reasonableness of the procedure against the customer's transaction profile and the alternatives the bank offered. ☐ Evaluate good faith in accepting an order that was materially out of pattern. ☐ Check the notice and objection deadlines in the statute and the account agreement, and object in writing immediately. ☐ For consumer international transfers, apply the remittance transfer rules in 12 C.F.R. Part 1005, including the cancellation window and error resolution rights. ☐ Document the loss timeline hour by hour; the difference between a two-hour and a two-day response is usually the difference between recovery and none.

Checks and deposited items

☐ Identify the defect — forged drawer's signature, forged endorsement, alteration, counterfeit, or duplicate presentment — because each allocates loss differently. ☐ Examine statements promptly and report, since the customer's duty of examination can preclude the claim, and the same-wrongdoer rule compresses the window after the first item. ☐ Obtain the item images, front and back, including all endorsements. ☐ Preserve the physical item where one exists. ☐ Confirm the funds availability schedule applied under 12 U.S.C. § 4001, 12 U.S.C. § 4002, and 12 C.F.R. Part 229 — and remember that availability is not finality. ☐ For substitute checks, evaluate the warranties and indemnities created under 12 U.S.C. § 5002 and 12 U.S.C. § 5003. ☐ Never disburse against a deposited item until it has cleared in fact.

Business accounts and business email compromise

☐ Assume no consumer protections apply. The account agreement and Article 4A govern. ☐ Reconstruct the instruction chain — who received the change request, from what address, what verification occurred, and who approved the payment. ☐ Pull the email headers and determine whether the counterparty's account was compromised or the address was spoofed. ☐ Determine whether a callback policy existed and whether it was followed; this fact drives every subsequent argument. ☐ Notify the counterparty immediately, because their systems may still be compromised and other payments may be in flight. ☐ Review the crime and cyber policies for a social engineering endorsement, its sublimit, and any verification condition precedent. ☐ Evaluate claims against the counterparty whose systems were breached, and expect a comparative fault negotiation rather than a clean answer. ☐ Freeze further payments to the affected vendor until the master file entry is re-verified independently.

Building the claim against the institution

☐ Assemble the procedural record: dates of notice, dates of acknowledgment, provisional credit or its absence, the written determination, and the documents produced. ☐ Identify each procedural violation separately, because these are provable and carry statutory damages. ☐ Request the fraud model alerts for the account during the relevant period, and internal communications about the specific claim. ☐ Request call recordings, which frequently contradict the institution's later account. ☐ Check the arbitration clause for an opt-out window, a small claims carve-out, and fee provisions. ☐ Calendar the limitations period, which is one year for many federal payment claims and runs from the violation rather than from discovery. ☐ Consider unfair or deceptive practice claims under 12 U.S.C. § 5531 and 12 U.S.C. § 5536 aimed at the institution's conduct. ☐ Consider state law preserved by 15 U.S.C. § 1693r, including elder protection statutes with private rights of action.

Pursuing the funds

☐ Identify the receiving account holder through the institution or by subpoena. ☐ Move for a temporary restraining order freezing identified accounts where the amount justifies it, and be prepared to post a bond. ☐ Plead conversion and money had and received against downstream recipients, including unwitting money mules. ☐ Trace through the chain while it is fresh; after conversion to digital assets or cash the trail typically ends. ☐ Coordinate with law enforcement, which can act faster than civil process in the first hours. ☐ Pursue restitution in any criminal case, without relying on it. ☐ Plan enforcement before judgment — see the money judgment enforcement guide.

Before closing the file: prevention

☐ Enable transaction alerts on every account, for every channel, at a low threshold. ☐ Implement verbal callback verification to a previously known number for every change to payment instructions. ☐ Require dual control and out-of-band approval for outbound wires above a defined threshold. ☐ Adopt positive pay and payee positive pay for check issuance. ☐ Apply ACH debit blocks and filters on operating accounts. ☐ Separate receivables and payables accounts to bound exposure. ☐ Replace SMS-based multi-factor authentication, which phone porting defeats. ☐ Write an urgency policy: no payment instruction is executed on the same call that changes it. ☐ Re-verify the vendor master file and log every change with the verification performed. ☐ Review the account agreement's security procedure annually and confirm the procedure in use matches it. ☐ Train on scenarios, not policies, and rehearse the "safe account" call and the vendor change request. ☐ Document the controls adopted, because the next insurer will ask and the next claim will turn on it.

📌 Two rules cover most of this checklist. First, classify the rail before doing anything else. Second, act in hours, not days — the recovery curve in payment fraud is steeper than in any other area of consumer or commercial law.

Model language for the key communications

Notice of unauthorized transfer (consumer). State the account number, list each disputed transaction with date and amount, state plainly that the transactions were not authorized by the account holder and that no one else had authority to initiate them, request written confirmation of receipt, demand provisional credit within ten business days if the investigation will exceed that period, and request copies of all documents relied on in any determination.

Demand for provisional credit. Reference the notice date, state that more than ten business days have elapsed without a final determination, cite the provisional credit obligation, and state that a failure to credit is an independent violation regardless of the ultimate outcome of the investigation.

Wire recall request. Identify the payment order by date, amount, originator, beneficiary name, beneficiary account number, and the sending institution's reference. State that the order was induced by fraud, request an immediate recall message to the beneficiary bank, request the reference number of that message, and request that the beneficiary bank be asked to place a hold pending investigation.

Freeze request to a receiving institution. Identify the incoming credit by date, amount, and sender, state that the funds are the proceeds of fraud, attach the fraud affidavit and police report, request a hold, and ask that any outgoing transfers from the account be reviewed.

Preservation letter. Identify the accounts and date range, and request retention of transaction records, authentication and device logs, IP records, call recordings, chat transcripts, fraud-monitoring alerts and dispositions, the complete dispute file, and all internal communications concerning the claim. State that spoliation sanctions will be sought if records are destroyed after receipt.

Notice to a compromised counterparty. State the facts neutrally, identify the fraudulent instruction and the address it came from, ask them to investigate their systems immediately, ask them to confirm the correct remittance details through a verified voice channel, and reserve all rights without making accusations that will harden the relationship before the facts are known.

Documenting the loss

☐ Build a single transaction table — date, time, amount, rail, sending account, receiving account, beneficiary name, and current status of each item. ☐ Build a communications timeline — every call, letter, and portal message with date, time, participants, and outcome. ☐ Build an evidence index — each document, its source, and how it was obtained. ☐ Quantify the loss precisely, separating principal, fees, interest, and consequential costs, and note which categories are recoverable on which theory. ☐ Identify every potentially responsible party and the theory against each, including institutions, counterparties, professionals, and recipients. ☐ Note every deadline in one place, with the earliest at the top.

When the institution denies the claim

☐ Get the denial in writing with the reasons stated. ☐ Request every document relied on, which the institution must provide on request for consumer electronic transfer disputes. ☐ Compare the denial's reasoning against the record — the authentication events, the device history, and the fraud alerts. ☐ Identify procedural failures independent of the merits, which are often the stronger claim. ☐ Escalate internally to the executive complaint function, which resolves a meaningful share of disputes without litigation. ☐ File a regulatory complaint, which frequently produces a substantive re-review. ☐ Evaluate arbitration versus small claims based on the clause, the amount, and the fee structure. ☐ Decide quickly, because the limitations period is short.

Rail-specific deadline table

Rail Deadline to act Runs from Consequence of missing it
Consumer electronic transfer 60 days Statement showing the transfer Unlimited liability for later transfers
Access device reported lost or stolen 2 business days Learning of the loss Cap rises from $50 to $500
Credit card billing error 60 days Statement Loss of statutory billing error rights
Card network chargeback Typically 120 days Transaction or expected delivery Loss of network remedy
Consumer ACH unauthorized debit 60 days Settlement or statement Loss of network return right
Business ACH 2 banking days Settlement Loss of return right
Wire recall Hours Transmission Funds withdrawn and unrecoverable
Check forgery Prompt examination; statutory outer limits Statement availability Preclusion of the claim
Federal payment claim limitations Commonly 1 year The violation Claim time-barred

⚠️ Print this table and keep it at intake. The most common malpractice risk in payment disputes is a missed clock, not a misapplied doctrine.

Special situations

☐ Real estate closing diversion. Notify the closing agent, the lender, the title underwriter, and both brokers within the hour; the underwriter may have a rapid response protocol. Preserve the email chain that carried the fraudulent instruction and identify whose system was compromised. ☐ Elder account. Report to adult protective services, check for state statutes permitting or requiring holds, and evaluate whether the institution's own elder-protection protocol was followed — see the elder financial exploitation checklist. ☐ Payroll diversion. Confirm whether the employee's direct deposit details were changed through a self-service portal, and treat the portal compromise as a data incident with its own notification analysis. ☐ Digital asset conversion. Contact the exchange immediately with the transaction hash and a law enforcement referral; on-platform funds can be frozen, off-platform funds usually cannot. ☐ Small business first loss. Use the incident to renegotiate the security procedure and adopt controls, because the second loss is what ends the business. ☐ Cross-border transfers. Add the correspondent bank chain to the recall request and expect materially longer timelines and lower recovery rates.

Closing the matter

☐ Confirm the credit posted and that fees, interest, and any resulting overdraft charges were reversed. ☐ Confirm no derogatory credit reporting resulted, and dispute any that did. ☐ Confirm the account is clean — no lingering authorized recipients, no unfamiliar linked accounts, no active third-party access tokens. ☐ Document what worked and what did not, because the same client will call again about a different rail. ☐ Deliver a short written prevention plan to the client, naming the controls to adopt and who owns each one.

Related Documents