Payment App Mistakes and Fraud: Unauthorized Transfers vs Money You Sent

Published by the Modern Lending Solutions editorial team. Last reviewed: October 30, 2026.

Short answer: a person-to-person payment from a bank account, prepaid account or app balance can be an electronic fund transfer under the federal rule, Regulation E. If someone else sent money from your account without your permission, including someone who tricked you into giving them your login or a code, that is an unauthorized transfer, and the provider must investigate once you report it. A payment you start yourself, to the wrong person or to a scammer, is treated differently and may not count as unauthorized. Report fast either way. This is general information, not legal or financial advice.

When a payment app transfer is covered

The CFPB says person-to-person payments can be electronic fund transfers, and that a payment that meets that definition is covered by the law and Regulation E (CFPB Electronic Fund Transfers FAQs, last updated January 15, 2025, read October 30, 2026; this page may be out of date). Under the rule, an account includes a checking, savings or other consumer asset account “held directly or indirectly” by a financial institution, and a prepaid account (12 CFR 1005.2(b)(1) and (3), eCFR, text up to date as of October 28, 2026, read October 30, 2026). A financial institution includes a bank or credit union and “any other person” that holds a consumer’s account or issues an access device and agrees to provide transfer services (1005.2(i)). The CFPB says that can include payment app providers that meet that test. For a balance kept in an app, see your rights on a prepaid card.

Unauthorized transfer or a payment you sent

The rule defines an unauthorized transfer as one “initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit” (1005.2(m)). It leaves out a transfer by someone you gave your card or login to, until you tell the provider that person is no longer allowed, and a transfer you make with fraudulent intent.

What happened	How the rule and the CFPB treat it
Someone got into your account and sent money	An unauthorized transfer (1005.2(m)).
A caller posing as your bank tricked you into sharing a login, texted code or card number, and then sent the money themselves	The CFPB says this is an unauthorized transfer. The official comment says a transfer by a person who got the access device “through fraud or robbery” is unauthorized (comment 2(m)-3, eCFR).
You sent the payment yourself to a scammer	You started it, so it was not “initiated by a person other than the consumer”. The provider may say it is not unauthorized under 1005.2(m).
You typed the wrong name, number or amount	The list of errors includes “An incorrect electronic fund transfer” (1005.11(a)(1)(ii)), but the rule text does not say whether a mistake you made yourself counts. Ask the provider and report it anyway.

A provider also cannot use its user agreement to take away these rights. The CFPB says an agreement that waives protections when you share account information with someone cannot be relied on, because the law bars waivers (CFPB).

How and when to report an error

The provider must follow the error rules for a notice, oral or written, that it receives no later than 60 days after it sends the statement that first shows the error, that lets it identify your name and account number, and that says why you think there is an error, with the type, date and amount if you can (1005.11(b)(1), eCFR). If you report by phone, it may ask for written confirmation within 10 business days, and must tell you that and where to send it (1005.11(b)(2)).

The CFPB says a provider may not make you file a police report or contact the merchant first before it starts the investigation (CFPB). How much of an unauthorized transfer you could owe depends on how fast you report after you learn of it; see lost or stolen debit card liability for the limits in 12 CFR 1005.6 (eCFR).

What the provider must investigate, and when

Step	What the rule says (1005.11(c) and (d))
Investigate	Promptly, and decide within 10 business days of your notice; 20 business days for transfers within 30 days after the first deposit to a new account.
If it needs longer	It may take up to 45 days only if it puts a provisional credit in your account within 10 business days and tells you within two business days after that; 90 days for some transfers, such as point-of-sale debit card purchases.
Fix the error	Within one business day after it finds an error.
Tell you the result	Within three business days after it finishes.
If it finds no error	A written explanation, and your right to ask for the documents it relied on, which it must send promptly.

The CFPB’s consumer page says the same: ten business days, or 20 for a new account, and a temporary credit while a longer review goes on (CFPB, last reviewed August 28, 2026, read October 30, 2026).

How a provisional credit works, only for the math

This example is only for the math, and all figures are example figures. You report a $400.00 transfer you did not make, and the provider needs more than 10 business days. If it has a reasonable basis to believe the transfer was unauthorized and has met the disclosure rules in 1005.6(a), it may hold back up to $50.00 from the provisional credit (1005.11(c)(2)(i)): $400.00 - $50.00 = $350.00 credited while it investigates. If it then finds an error, it must correct it within one business day.

If you sent money to a scammer

Tell the app provider and your bank or card issuer at once, through the contact details in the app or on your card, not a number from a message.
Ask in writing whether they treat it as an error under Regulation E, and keep their answer.
Report the scam to the FTC at ReportFraud.ftc.gov, and see the CFPB’s list of where to get help (CFPB).
If you shared personal details, use IdentityTheft.gov.

A later offer to get the money back for a fee is its own scam; see recovery scams.

Related guides

Pressure by text or phone is covered in fake loan texts and calls, and fees asked up front in advance-fee loan scams. Card charges follow other rules; see unauthorized credit card charges. To complain about a provider, see how to file a complaint or use consumerfinance.gov/complaint.

Questions to ask the provider

Are you a financial institution under Regulation E for this account, and is this payment an electronic fund transfer?
Do you treat a payment I sent to the wrong person as an error, and can you ask the receiver to return it?
When did you receive my notice, and when will you decide?
If you need more than 10 business days, when will the provisional credit post?
Can I have the documents you relied on?

Checklist

Report within 60 days after the statement that first shows the problem, sooner if you can.
Give your name, account number, and the type, date and amount.
Confirm in writing within 10 business days if asked.
Login or code taken by a trick, then used by someone else: an unauthorized transfer, per the CFPB.
A payment you sent yourself: ask in writing how the provider treats it, and report the scam.

Start your loan request How our service works

Sources

Disclosure: Modern Lending Solutions is not a lender, loan broker or agent for any lender or loan broker, and does not make credit decisions. Any compensation we receive is paid by participating lenders, only for advertising services. This guide is general information, not financial or legal advice.

Sent Money by App to the Wrong Person, or a Charge You Did Not Make?