Toolkit · Consumer Protection

The Fraud Response and Financial Exploitation Toolkit

15 U.S.C. § 1643

Type: Toolkit
Jurisdiction: National
Date: 2025-10-25
Topic: Consumer Protection

This toolkit assembles the working materials for a fraud or exploitation matter into modules that can be lifted and used. It supplies a first-hour card, a payment recovery matrix, letters for a wire recall, an EFTA error notice, a billing error dispute, a credit reporting dispute, and an exploitation notice to a financial institution. An undue influence evidence checklist and a power of attorney accounting demand cover exploitation cases. A scam taxonomy card and a prevention card cover the front end. Reference tables cover the authorities, the report directory, and the vocabulary. Every authority cited is linked to its text on uplaw.us.

The Fraud Response and Financial Exploitation Toolkit

Consumer Protection > Fraud and Scams | Published 25 October 2025 - Updated 24 August 2026 | UpLaw - uplaw.us

Module 1 is a card. Print it, keep it by the phone, and give a copy to anyone in the family who might one day need it at four in the afternoon with their hands shaking.

Keywords: first hour, recovery matrix, recall, error notice, exploitation, undue influence, prevention

Module 1 — The first-hour card

SOMEONE HAS TAKEN MONEY. DO THIS NOW.

1. Do not prepare a file. Call first.

2. Call the bank, card issuer, or app — the sending side. Wire → say the words: "I need to request a recall of a wire sent today." Debit or app → say: "I am reporting an error under the Electronic Fund Transfer Act and requesting provisional credit." Credit card → say: "I am asserting a billing error."

3. Write down the case number and the representative's name.

4. Call the receiving bank if you know it.

5. Change the email password first. Then everything financial.

6. Do not delete any messages.

7. Write down what happened, with times, today.

8. Then make the reports (Module 8).

Every hour matters. Funds are moved onward within the first hour by design.

Give this card to the person, not the file. The most common cause of unrecovered loss is a delay of hours, and the delay is almost always caused by someone assembling documents before picking up the phone.

Module 2 — Payment recovery matrix

How the money moved	Protection	Odds	Window	First call
Credit card	15 U.S.C. § 1643 · § 1666	High	60 days from statement	Issuer
Debit — unauthorized	15 U.S.C. § 1693f · § 1693g	High if fast	2 business days	Bank
Debit / app — induced	Generally none	Low	Hours	Bank, then app
ACH	EFTA where consumer-initiated	Moderate	Days	Bank
Domestic wire	None	Low, falling hourly	Hours	Sending bank — recall
International wire	None	Very low	Hours	Sending bank; FBI complaint center
Payment app to a stranger	Generally none	Low	Hours	App, then bank
Gift card	None	Very low	Immediately	Card issuer, with numbers
Cryptocurrency	None	Very low	Immediately	Exchange; report addresses
Cash	None	None	—	Police
Marketplace purchase	Platform protection	Moderate to high	Per platform	The platform

Two observations that change outcomes.

The last column is the whole toolkit. Calling the wrong institution first costs the window.

And the marketplace row is the most commonly missed remedy, because the victim is focused on the bank while the platform's purchase protection sits unused.

Module 3 — Wire recall request

Re: [customer name] · Account [___] · Wire sent [date] at approximately [time]

I request an immediate recall of the following wire transfer, which was induced by fraud:

Amount: $[] · Date and time: [] · Beneficiary: [] · Receiving institution: [] · Reference / IMAD-OMAD: [___]

Please initiate the recall now, notify the receiving institution that the funds are fraud proceeds, and request that the account be frozen.

Please confirm in writing: (1) the time the recall was initiated; (2) the response of the receiving institution; (3) the amount, if any, recovered or frozen; and (4) the case number and the name of the representative handling this matter.

A report is being filed with law enforcement and with the FBI's internet crime complaint center today.

Then call the receiving bank directly and report the account as receiving fraud proceeds. Institutions will speak to a victim about a fraud report even where they will not discuss the account.

Module 4 — EFTA error notice

Send the same day as the phone call. The phone call starts the clock; this letter proves it.

Re: [customer] · Account [___]

This is written notice of an error under the Electronic Fund Transfer Act, 15 U.S.C. § 1693f.

The transfers below were not authorized by me: [Date · amount · payee · method]

I first learned of the loss on [date] and reported it by telephone on [date] to [representative], case number [___].

I request:

A prompt investigation.

Provisional credit to my account pending the investigation, as required where the extended investigation period is used.

Written explanation of the results, and copies of all documents relied upon.

Confirmation of the date this notice was received.

I note the liability limits at 15 U.S.C. § 1693g and that this notice is given within the applicable period.

Billing error letter, for a credit card

Re: [cardholder] · Account [] · Statement dated []

This is notice of a billing error under 15 U.S.C. § 1666. The charge of $[___] posted [date] to [merchant] is [unauthorized / for goods not delivered / for goods not as described].

I request that the amount be corrected, and I note that the creditor may not report the disputed amount as delinquent while the dispute is pending. Please also process a chargeback under the applicable network rules. Regulation Z is at 12 C.F.R. Part 1026.

Module 5 — Identity theft response

In order, and the first two are free and take minutes.

1. Freeze credit at each nationwide consumer reporting agency. Free, and stronger than a fraud alert. Consider specialty agencies as well.

2. Obtain the file under 15 U.S.C. § 1681g.

3. File the identity theft report with the Federal Trade Commission and a police report locally. Several rights depend on having one.

4. Request the application and transaction records for each fraudulent account — a right of an identity theft victim, and frequently the document set that identifies the perpetrator.

5. Dispute and block, using this letter:

Re: [consumer] · File [___]

The following items result from identity theft and are disputed: [creditor · account · amount · date opened].

Enclosed: my identity theft report, police report number [___], and proof of identity and address.

I request that these items be blocked and that you notify each furnisher. I further request, as an identity theft victim, copies of the application and transaction records relating to each account listed above.

The reinvestigation duty is at 15 U.S.C. § 1681i; the accuracy requirement at 15 U.S.C. § 1681e; reporting limits at 15 U.S.C. § 1681c; and permissible purposes at 15 U.S.C. § 1681b, with definitions at 15 U.S.C. § 1681a.

6. When collectors call, send a validation request under 15 U.S.C. § 1692g and screen conduct under 15 U.S.C. § 1692e, 15 U.S.C. § 1692f, and 15 U.S.C. § 1692d, with damages at 15 U.S.C. § 1692k and reporting liability at 15 U.S.C. § 1681n and 15 U.S.C. § 1681o.

7. For any federal suit, plead dissemination and harm — Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) require concrete injury, which in practice means publication to a third party.

8. Check email forwarding rules, recovery addresses, and mail forwarding. A fraudster who adds a forwarding rule keeps seeing everything after the password changes.

Module 6 — Exploitation notice to a financial institution

Re: [account holder] · Account [___]

The following transfers from this account were procured by financial exploitation: [dates and amounts].

[Account holder] is [age]. [Describe the circumstances: isolated from family by the recipient · dependent on the recipient for care and transportation · diagnosed cognitive impairment · a sudden change in a long-standing pattern.]

I request that you:

Place a hold on further disbursements from this account.

Provide the complete transaction and communication record for the past [___] months.

Advise whether a trusted contact was on file and whether it was contacted.

Advise what steps were taken under your elder financial exploitation procedures, and whether a temporary hold was considered.

Provide the name and title of the employee who processed each transfer, and any notes made at the time.

A report has been filed with adult protective services on [date], reference [___], and with [law enforcement / the state securities regulator].

Why item 5 matters. The institution's own contemporaneous notes are the best evidence of what the employee observed — including whether the customer was on the phone during the transaction, could not explain the purpose, or was instructed not to answer questions. Those facts, preserved now, are what make a later claim answerable.

Module 7 — Undue influence evidence checklist

The elements courts actually look for. Document each one, with dates.

☐ Isolation — from family, friends, prior advisors, or a long-standing professional ☐ Dependency — on the influencer for care, transportation, medication, or information ☐ A confidential or fiduciary relationship — agent, caregiver, trustee, advisor, clergy ☐ The influencer's participation in procuring the transaction — arranging the meeting, choosing the professional, transporting, being present, supplying the instructions ☐ A sudden change in a long-established estate plan, beneficiary designation, or account arrangement ☐ Unnatural disposition — favoring the influencer over natural objects of bounty ☐ Secrecy and haste ☐ The victim cannot explain the transaction in their own words ☐ Diminished capacity, with a contemporaneous assessment where obtainable ☐ Disparity in the exchange — value out, nothing in

Where several elements are present, many jurisdictions shift the burden to the influencer to prove the transaction's fairness. The documentation has to be contemporaneous, which means the file is built now, not when the case is filed.

Power of attorney accounting demand

Re: Power of attorney executed by [principal] on [date], naming [agent]

Demand is made for a complete accounting of all transactions undertaken on behalf of [principal] from [date] to the present, including every transfer, withdrawal, gift, sale, and payment, with supporting documentation.

An agent under a power of attorney is a fiduciary, owing duties of loyalty, care, and disclosure, and may not use the principal's assets for the agent's own benefit absent express authority.

The power of attorney is revoked effective [date], and notice of revocation is being given to each institution. Failure to provide the accounting within [___] days will result in a petition to compel, together with claims for breach of fiduciary duty, conversion, and surcharge.

Module 8 — Report directory

Where	Why	When
Sending institution	The only route to a recall or provisional credit	First, immediately
Receiving institution	Can freeze remaining funds	Same hour
Local police	Required by many institutions and by identity theft rights	Same day
Federal Trade Commission	Federal clearinghouse; identity theft report	Same day
FBI internet crime complaint center	Wire recall escalation; cryptocurrency	Same day
State attorney general	UDAP enforcement; mediation	Days
Adult protective services	Vulnerable adult — investigates and intervenes	Same day
State securities / insurance regulator	Investment or policy involved	Days
Consumer financial protection complaint	Written institution response	Days
Platform / marketplace	Purchase protection; account bans	Same day
Card network, via the issuer	Chargeback rights broader than the statute	Days

File them all. None substitutes for the first row, and several are prerequisites for the others.

Module 9 — Timeline template

Write this the same week. Memory does not survive six months of litigation.

What happened	Who said what	Evidence
First contact — how, from what number, displaying as what	Exact words if remembered	Screenshot / call log
What was asked for
Any instruction not to tell anyone	Quote it
Transfer initiated — method, amount, recipient		Receipt / confirmation
Bank interaction — branch, employee name, what was asked	Quote it
Discovery of the fraud
First call to the institution	Representative, case number
Written notice sent		Delivery proof
Reports filed	Reference numbers

The two rows in bold are the ones that decide later claims — the secrecy instruction proves the fraud, and the bank interaction determines whether the institution had indicia of coercion in front of it.

Module 10 — Scam taxonomy card

Scam	The tell
Impostor call — bank, tax agency, police, utility, tech company	They called you, and they want money moved or software installed
Tech support	Any request for remote access, ever
Grandparent	"Don't tell my parents" — the secrecy instruction
Romance	Money requested by someone never met in person
Investment / crypto	You cannot withdraw your own money without paying more
Business email compromise	Payment instructions arriving by email, changed late
Employment / overpayment	Deposit a check and send part of it back
Advance fee	Paying in order to receive money
Government imposter	Gift cards, wire, or crypto demanded. No agency does this
Recovery scam	They contacted you about a loss you never told them about

The five universal tells: they called you · they want secrecy · they want speed · they want an irreversible payment method · and they discourage verification through a channel you choose.

The one-sentence defense: "I'm going to hang up and call the number on my statement."

Module 11 — UDAP demand letter

Start here, not with common-law fraud. State UDAP statutes typically offer a lower proof standard, statutory or minimum damages, and attorney fee shifting.

Re: [claimant] v. [respondent] · Transaction of [date] · $[___]

Demand is made for $[___] arising from the following unfair and deceptive acts and practices, in violation of [state UDAP statute]:

1. The representation. On [date], [respondent] represented that []. That representation was false. [Evidence.] 2. Materiality. The representation was material to the decision to [pay / transfer / enter the transaction]. 3. Reliance and loss. In reliance, [claimant] paid $[] on [date], and received [nothing / goods not as described]. 4. Additional practices. [Failure to disclose · high-pressure tactics · misrepresentation of affiliation · demand for an irreversible payment method · false urgency.]

Statutory damages, multiple damages, and attorney fees are sought as the statute provides.

Unless resolved within [___] days, suit will be filed. Federal analogues, for context, include 15 U.S.C. § 45 (unfair or deceptive acts), 15 U.S.C. § 6102 (telemarketing), and 47 U.S.C. § 227 (automated calls and texts).

And before filing anything: plan the collection. A judgment is not money — see Enforcing a Money Judgment: A Comprehensive Guide to Discovery, Liens, Levy, and Fraudulent Transfer and The Judgment Enforcement and Creditor Remedies Toolkit.

Small claims court is underrated for losses within the limit against an identifiable local defendant: fast, cheap, and no lawyer required.

Module 12 — Prevention card

Six habits, each of which defeats an entire category.

1. "I'll hang up and call the number on my statement." — defeats every impostor scam. 2. Never grant remote access to a device. — defeats tech support scams. 3. Use a credit card with strangers. — converts the weakest legal position into the strongest. 4. Any instruction not to tell anyone is proof of fraud. — defeats grandparent scams and most exploitation. 5. Freeze your credit. — free, and it prevents new-account identity theft outright. 6. Verify changed payment instructions by phone, to a number already on file. — defeats business email compromise.

Two structural measures worth more than all six:

A trusted contact on file at every bank and brokerage for an older adult. A named person who reviews mail and statements monthly, with permission. Exploitation depends on isolation, and this is the thing isolation cannot survive.

Module 13 — Reference tables

Authorities

Authority	Proposition
15 U.S.C. § 45	Unfair or deceptive acts or practices
15 U.S.C. § 1601 · § 1635 · § 1637 · § 1640	TILA; rescission; disclosure; remedies
15 U.S.C. § 1643 · § 1666	Card liability cap; billing error resolution
15 U.S.C. § 1681–1681s	Credit reporting and identity theft rights
15 U.S.C. § 1692–1692k	Debt collection
15 U.S.C. § 1693 · § 1693f · § 1693g	EFTA; error resolution; liability tiers
15 U.S.C. § 6101 · § 6102 · § 6801	Telemarketing; financial privacy
47 U.S.C. § 227	Automated calls and texts
12 C.F.R. Part 1026 · 16 C.F.R. Part 429	Regulation Z; cooling-off rule
18 U.S.C. § 1028 · § 1030 · § 1341 · § 1343 · § 1344 · § 1349	The federal fraud offenses
18 U.S.C. § 1962 · § 1964	Racketeering; civil treble damages
42 U.S.C. § 1396p	The Medicaid look-back consequence
Spokeo · TransUnion	Standing on a reporting claim
Cleveland · Skilling · Kelly · Ciminelli · Dubin	The narrowing of the fraud statutes
Neder · Shaw · Escobar	Materiality; bank fraud; false claims

Vocabulary

Unauthorized — the consumer did not initiate it; statutory protections apply. Authorized-but-induced — the consumer initiated it after being deceived; generally outside the statutes. Recall — the wire request that must be made in hours. Provisional credit — the recredit an institution must make in many circumstances while investigating. Chargeback — the card network remedy, broader than the statute. Freeze — free, and the strongest identity theft protection. Trusted contact — the person an institution may call before disbursing. Undue influence — the doctrine that undoes transfers. Recovery scam — the second fraud, aimed at victims of the first.