How Do Banks Investigate Unauthorized Transactions

Last updated: 8 November 2026 · Originally published 1 November 2025

A bank investigates an unauthorized transaction by receiving the customer’s notice, logging the date, collecting the transaction and device evidence, deciding whether an error or fraud occurred, and then crediting, reporting back and correcting within legal deadlines. The deadlines depend on the region: in the US, Regulation E sets 10 business days to decide (extendable to 45 days if the bank provisionally credits the account); in the EU, PSD2 requires a refund by the end of the following business day, unless the bank suspects fraud and reports its grounds in writing to the national authority; in the UK, the APP reimbursement rules cover a different case, authorised push payment fraud. This article walks through each regime separately, then shows where AI agents can prepare the case so that a human investigator decides faster and with a better record.

What counts as an unauthorized transaction, and how is it different from authorised fraud?

An unauthorized transaction is a payment the account holder did not make or approve. In authorised push payment (APP) fraud, the customer does approve the payment but was deceived into making it. The two are handled under different rules, so the first step of every investigation is classification.

The UK Payment Systems Regulator makes the point on its own page: “APP fraud is different to unauthorised fraud” (PSR). A card payment made with stolen card data is unauthorized. A transfer made by a customer who was talked into paying a fake supplier is authorised, even though the customer was defrauded.

Investigators usually sort cases into three groups:

1. True fraud. A criminal uses stolen card details or account credentials.
2. Friendly fraud. The cardholder disputes a legitimate charge, for example a forgotten free-trial cancellation or an in-app purchase made by a child.
3. Family fraud. A relative or friend uses the card without permission.

The group matters because it changes the evidence the bank needs and, in some regimes, who bears the loss.

What are the warning signs that start an investigation?

Most investigations start with a customer notice, but banks also open cases from their own monitoring. Typical triggers are payments the customer does not recognise, sudden overdrafts, unknown accounts in the customer’s name, collection letters for accounts the customer never opened, unusually large charges, and charges in unusual locations.

Contactless cards are one area of concern: even after the account behind a card has been cancelled, fraudulent charges can still get through in some cases, which is why customers should review their statements regularly.

How does a bank investigate, step by step?

The process is the same in principle across regions, even though the clocks differ.

1. Intake and timestamp. Record exactly when and how the notice arrived (oral, written, app). Most legal clocks start at receipt.
2. Classification. Unauthorized, authorised-but-deceived (APP), merchant dispute, or friendly fraud.
3. Evidence collection. Transaction timestamps, channel, device and IP data, geolocation, login history, card or token status, and the customer’s own account of where they were.
4. Pattern checks. Compare the disputed items with the customer’s normal behaviour and with known fraud patterns.
5. Provisional decision and customer communication. Decide whether to credit provisionally, within the regional deadline.
6. Final decision. An investigator, not a model, decides whether an error or fraud occurred.
7. Reporting back and correction. Tell the customer the result, correct the account, and record the reasoning.
8. Recovery. Where a merchant is involved, the bank may pursue a chargeback; the merchant can contest it through chargeback representment, and the bank then reviews the merchant’s evidence.

How long does a US bank have to investigate? (Regulation E)

Under Regulation E, a bank must determine within 10 business days of receiving a notice of error whether an error occurred. If it needs up to 45 days, it must provisionally credit the customer within those 10 business days. This section covers Regulation E only; credit cards fall under a different regime (Regulation Z) that this article does not cover.

The rule, 12 CFR 1005.11(c)(1), reads: “A financial institution shall investigate promptly and, except as otherwise provided in this paragraph (c), shall determine whether an error occurred within 10 business days of receiving a notice of error. The institution shall report the results to the consumer within three business days after completing its investigation. The institution shall correct the error within one business day after determining that an error occurred.” (eCFR 1005.11)

Note “business days” throughout: the rule counts business days, not calendar days.

When can the investigation run to 45 days?

Under 1005.11(c)(2), the bank may take up to 45 days if it:

• provisionally credits the consumer’s account in the amount of the alleged error (including interest where applicable) within 10 business days of receiving the error notice; and
• informs the consumer within two business days after the provisional crediting.

The consumer has full use of the funds during that time. The bank may withhold a maximum of $50 if it has a reasonable basis to believe the transfer was unauthorized and has satisfied 1005.6(a). Two exceptions exist to the provisional credit: written confirmation was required but not received within 10 business days of an oral notice, and Regulation T accounts.

So the bank does not simply “ask for an extension”: the longer clock is conditional on the credit.

Are there longer or shorter periods?

Yes. Under 1005.11(c)(3), the 10-business-day period becomes 20 business days if the transfer occurred within 30 days after the first deposit. And “the applicable time is 90 days in place of 45 days” for transfers that (A) were not initiated within a state, (B) resulted from a point-of-sale debit card transaction, or (C) occurred within 30 days after the first deposit. This is not “90 days for all debit cards”.

How much can the customer lose? (1005.6)

For an accepted access device that is lost or stolen, liability depends on how quickly the consumer reports (eCFR 1005.6):

Customer action	Maximum liability under 1005.6
Notice “within two business days after learning of the loss or theft of the access device”	Not more than the lesser of $50 or the amount of unauthorized transfers that occur before notice
Later notice	The lesser of $500 or the sum of the amounts listed in (b)(2)

The notice period in the rule is two business days.

Worked example: one disputed card payment through the Reg E clock

1. Day 0: the consumer gives notice of error. The bank must investigate promptly and determine whether an error occurred within 10 business days.
2. If it needs longer: it provisionally credits the amount (with interest where applicable) within those 10 business days and tells the consumer within two business days after crediting; the investigation may then run to 45 days.
3. After the investigation: it reports the results within three business days and, if an error occurred, corrects it within one business day.
4. Only in the 1005.11(c)(3) cases (new account, transfer not initiated within a state, point-of-sale debit): 20 business days instead of 10, and 90 days instead of 45.
5. Consumer liability follows the table above; unauthorized transfers on a statement must be reported within 60 days of the statement being sent (1005.6(b)(3)).

Has Regulation E changed recently? The eCFR source note for part 1005 ends with “83 FR 6417, Feb. 13, 2018”; the sections quoted above are the text shown on eCFR as of 29 October 2026.

What does a bank in the EU have to do? (PSD2)

Under PSD2, the payer’s bank must refund an unauthorised payment immediately and in any event no later than the end of the following business day, except where it has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing. This section covers the EU directive; because PSD2 is a Directive, national transposition laws apply in each member state.

Article 73(1) of Directive (EU) 2015/2366 says the payer’s payment service provider “refunds the payer the amount of the unauthorised payment transaction immediately, and in any event no later than by the end of the following business day, after noting or being notified of the transaction, except where the payer’s payment service provider has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing.” (PSD2, EUR-Lex)

Two related points:

• Notification window (Art. 71(1)). The payer must notify “without undue delay on becoming aware”, and “no later than 13 months after the debit date”. The 13-month limit does not apply where the payment service provider failed to provide the transaction information.
• Liability (Art. 74(1)). Payer liability is up to EUR 50 for a lost or stolen instrument, nil in certain cases, and the payer bears all losses if acting fraudulently or with “intent or gross negligence”.

Is PSD3 changing this?

Not yet. The PSD3/PSR package is not yet adopted; formal adoption is pending. Until it is adopted and applies, PSD2 remains the instrument in force. Do not plan against refund terms or application dates from press summaries of the draft.

What is different in the UK? (APP reimbursement)

The UK rules cover authorised push payment fraud, which is a different case from the unauthorised transactions above. The PSR’s protections started on 7 October 2024, apply to payments over Faster Payments or CHAPS, and as of the PSR page (accessed 2 November 2026) the maximum claim is £85,000.

Key points from the PSR page (PSR; the same page states “These protections start on 7 October 2024, applying to payments made on or after this date.”):

• Claims must be made “within 13 months of making the fraudulent payment”.
• A firm may apply an optional excess of up to £100, which cannot be applied to vulnerable consumers.
• “You can expect to be reimbursed within 5 business days of making your claim”, but firms can “stop the clock” when they need more information, and must arrive at an outcome within 35 business days.

The 5-business-day figure is the starting expectation, not the limit: read it together with the stop-the-clock rule and the 35-business-day outcome deadline.

Authorised vs unauthorized: who bears the loss?

	US (Reg E)	EU (PSD2)	UK (APP)
Case covered	Unauthorized electronic fund transfers and other errors	Unauthorised payment transactions	Authorised push payments made after deception
Core deadline	Determine within 10 business days; up to 45 days with provisional credit	Refund by the end of the following business day	Reimbursement expected within 5 business days; stop-the-clock; outcome within 35 business days
Reporting window for the customer	Two business days after learning of the loss or theft for the $50 tier (1005.6(b)(1))	13 months from the debit date	13 months from the payment
Customer exposure	$50 / $500 tiers	Up to EUR 50; full loss if fraud or intent or gross negligence	Optional excess up to £100; not for vulnerable consumers
Key caveat	Credit conditions in 1005.11(c)(2)	Fraud-suspicion exception, reported in writing to the authority	Maximum £85,000 as of PSR page accessed 02.11.2026

The table is a map, not legal advice. Check the national law and your own contracts before turning it into policy.

Can AI make the refund decision?

No, not on its own, and the fraud-detection carve-out in the EU AI Act does not change that. The point of an investigation is a decision that affects a customer’s money and rights, and that decision should stay with a named human investigator.

The EU AI Act (Regulation (EU) 2024/1689), Annex III point 5(b), lists AI systems “intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud;” (EUR-Lex). That is a carve-out from one high-risk category. It does not mean fraud AI is exempt from the AI Act: other Annex III points and other rules may still apply depending on the use case, so classify each system by what it does.

Dates moved in 2026. Regulation (EU) 2026/1744 (Digital Omnibus on AI) of 8 July 2026 entered into force on 27 July 2026. Its amended Article 113(3), point (c), applies the high-risk rules for systems under Article 6(2) and Annex III from 2 December 2027, and for systems under Article 6(1) and Annex I from 2 August 2028; the original date was 2 August 2026 (EUR-Lex). The Omnibus does not change Annex III point 5(b).

How do AI agents support unauthorized-transaction investigations?

An AI agent prepares the case and tracks the deadline clock; the investigator decides. This is the same pattern banks already use in AML alert handling, where agents triage alerts and assemble the case file for a human investigator.

For a dispute or fraud notice, an agent can:

1. Open the case and start the clock. Read the notice, record the receipt time and channel, and compute the regional deadlines (for example, the 10-business-day point and the provisional-credit decision point under Reg E, or the end of the following business day under PSD2).
2. Collect the evidence. Pull the transaction record, device and IP data, geolocation, login and card-status history, and prior disputes by the same customer or merchant.
3. Build the timeline. Order events from the last normal activity to the disputed items, and flag gaps.
4. Pre-fill the case file. Draft the classification (unauthorized, APP, friendly fraud), the evidence summary and the customer letter for review.
5. Flag the exceptions. Surface the points a human must judge: grounds for suspecting fraud, a vulnerable-consumer marker, an oral notice awaiting written confirmation.
6. Write the audit trail. Log which data sources were read and what the agent proposed.

What stays with a human:

Step	Agent	Human investigator
Deadline timer and reminders	Calculates and alerts	Confirms the clock start
Evidence gathering and timeline	Prepares	Reviews, requests more
Classification	Proposes	Decides
Provisional credit / refund	Prepares the recommendation	Decides and signs off
Suspicion of fraud and report to authority	Highlights indicators	Decides and reports
Customer letter	Drafts	Approves and sends
Audit record	Writes	Owns the record

What the agent does on the clock

The agent starts the deadline clock when the notice arrives, collects the evidence (transaction log, device and login events, prior disputes), orders the timeline, pre-fills the case file, and flags the day on which provisional credit is due. The investigator decides and signs off; every step of the agent is logged, so the audit trail shows what was retrieved, when, and who approved. Whether a refund is due stays a human decision.

S-PRO has its own agentic platform, S-PRO Agents, the core of our products and client solutions. For transaction-monitoring and case-handling agents, see AI agents for AML and transaction monitoring in banks.

Planning an agent for dispute and fraud case handling? Talk to our engineers about the AML and transaction-monitoring use case: AI agents for AML transaction monitoring.

What does a defensible audit trail look like?

A defensible audit trail lets a regulator or an ombudsman reconstruct what the bank knew, when it knew it, and who decided. Use this checklist:

• Notice receipt time, channel and the person or system that logged it.
• The deadline calculation and which regime applied (and why).
• Every data source read, with timestamps and versions.
• The agent’s proposal and the human decision, kept as two separate records.
• The reasoning for any fraud-suspicion hold, including the written communication to the authority where PSD2 requires it.
• The provisional-credit decision and its date (Reg E), or the refund date (PSD2).
• The customer communications, as sent.
• Overrides: where the investigator departed from the agent’s proposal, and why.

What goes wrong in practice?

• Wrong clock. Treating “10 business days” as “10 days”, or treating the 45-day route as automatic. Under Reg E it depends on the provisional credit.
• Missing the exception text. Quoting the PSD2 next-business-day refund without the fraud-suspicion exception, or the UK 5-business-day figure without stop-the-clock.
• Misclassification. Treating an APP case as unauthorized, or the reverse, and applying the wrong regime.
• Agent overreach. Letting a model approve or deny a refund. Keep the decision with a human and log it.
• Thin records. A decision with no evidence log is hard to defend later.
• Mixing regimes. A bank operating in several jurisdictions needs the regime chosen per case, not one blended policy.

How can banks reduce unauthorized transactions in the first place?

Controls on the bank side: regular audits, separation of payment-processing duties, two-party authorization for wires and ACH, daily reconciliation, limited remote access for employees, and ACH filters and blocks. On the customer side: use secure payment connections, keep card data private, shield PIN entry, and keep the bank’s contact details handy so a loss is reported quickly, which also reduces exposure under the notice tiers above.

FAQ

How long does a bank have to investigate an unauthorized transaction in the US?

Under Regulation E, 12 CFR 1005.11(c)(1), the bank must determine within 10 business days of receiving the notice whether an error occurred. It can take up to 45 days only if it provisionally credits the consumer’s account within those 10 business days. Longer periods apply in specific cases, such as new accounts.

Does an EU bank have to refund an unauthorised payment immediately?

Under PSD2 Article 73(1), the bank must refund immediately and no later than the end of the following business day. The exception is where the bank has reasonable grounds for suspecting fraud and communicates those grounds to the national authority in writing. National transposition law also applies.

Is UK APP fraud the same as unauthorised fraud?

No. The PSR states that APP fraud is different to unauthorised fraud: in APP fraud the customer authorises the payment after being deceived. The UK reimbursement rules started on 7 October 2024; as of the PSR page accessed on 2 November 2026 the maximum claim is £85,000.

Can AI decide whether to refund a disputed transaction?

It should not decide alone. An AI agent can gather evidence, build the timeline and track deadlines, but the refund and fraud-suspicion decisions should stay with a human investigator, with the agent’s proposal and the human decision logged separately.

Is fraud-detection AI exempt from the EU AI Act?

No. Annex III point 5(b) excludes AI systems used to detect financial fraud from the credit-scoring high-risk category only. Other Annex III points and other rules may apply by use case. Under Regulation (EU) 2026/1744, Annex III high-risk obligations apply from 2 December 2027.

Will PSD3 change the refund rules?

The PSD3/PSR package is not yet adopted and formal adoption is pending. Until then PSD2 and its national transposition laws apply. Plan with PSD2 and review the final text once it is published.

What is provisional credit under Reg E?

If the bank cannot finish within 10 business days, it must credit the consumer’s account with the amount of the alleged error (with interest where applicable) within 10 business days, and tell the consumer within two business days, to extend its investigation to 45 days. The consumer has full use of the funds. Narrow exceptions apply, for example where the bank requires written confirmation of an oral notice and does not receive it within 10 business days (12 CFR 1005.11(c)(2)).

How much can a consumer lose under Reg E?

If the consumer reports the loss or theft of the access device within two business days of learning of it, liability is the lesser of $50 or the unauthorized transfers before notice; after that, the lesser of $500 or the sum of the amounts listed in 1005.6(b)(2). Unauthorized transfers on a statement must be reported within 60 days of the statement being sent (12 CFR 1005.6).

What should a dispute case file contain?

In S-PRO’s view: the notice with its date, the transaction and authentication evidence, the timeline, the decision with its reason and approver, the provisional-credit and deadline dates, and the customer communication. It should be reconstructable without the person who handled it.

Talk to S-PRO about AI agents for dispute and fraud case handling

If your investigators spend their time collecting evidence and chasing deadlines instead of deciding cases, an agent can prepare the file and the clock while your team keeps the decision. S-PRO is a Swiss international firm headquartered in Zurich, with 250+ engineers. Start with the use case: AI agents for AML and transaction monitoring in banks. To scope and build the agent itself, see AI agent development, or book a discovery call. S-PRO builds AI agents for banks on its own agentic platform, S-PRO Agents, the core of our products and client solutions; across 100+ AI projects delivered, 40+ have been agentic AI projects.

Related reading: Core Banking Integration Systems: Challenges and Strategies · Fintech software development · Security and compliance for financial institutions

Sources

1. 12 CFR 1005.11, Procedures for resolving errors: https://www.ecfr.gov/current/title-12/chapter-X/part-1005/section-1005.11
2. 12 CFR 1005.6, Liability of consumer for unauthorized transfers: https://www.ecfr.gov/current/title-12/chapter-X/part-1005/section-1005.6
3. Directive (EU) 2015/2366 (PSD2), Arts. 71, 73, 74: https://eur-lex.europa.eu/eli/dir/2015/2366/oj
4. Regulation (EU) 2024/1689 (AI Act), Annex III 5(b): https://eur-lex.europa.eu/eli/reg/2024/1689/oj
5. Regulation (EU) 2026/1744 (Digital Omnibus on AI), Art. 113(3)(c): https://eur-lex.europa.eu/eli/reg/2026/1744/oj
6. PSR, APP fraud reimbursement protections: https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/
7. European Parliament Legislative Observatory, procedure 2023/0210(COD), PSD3/PSR status: https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2023/0210(COD) (accessed 2 November 2026)