Talking to Your Bank

One distinction decides everything

Did someone else move the money, or did you?

Everything about what you can get back turns on that single question, and it is worth being precise about which side you are on before you ring anybody.

Unauthorised means a payment you did not make: card details used by a stranger, an account taken over, a transfer you never initiated. Here the law is strongly on your side almost everywhere.

Authorised but deceived means you made the payment yourself, believing something that was not true. In law this is your instruction, carried out correctly. That is the whole problem.

If it was unauthorised

In the EU, PSD2 gives you a refund by the end of the following business day, and the burden of proof is on the bank rather than on you — the mere fact that your card or app was used is not enough for it to claim you authorised it. Your liability is capped at around €50 unless you acted fraudulently or with gross negligence. You must notify without undue delay and in any case within 13 months of the debit.

In the United States, Regulation E defines an unauthorised transfer as one "initiated by a person other than the consumer without actual authority", which is exactly this case. Report the error within 60 days of the statement it appears on. The bank has ten business days to decide, or forty-five if it gives you provisional credit in the meantime.

If you made the payment yourself

United Kingdom. You have a right. Mandatory reimbursement since October 2024, £85,000 per claim.

European Union. You have no right. PSD2's refund machinery covers unauthorised transactions only, and that is why banks decline. The Payment Services Regulation, agreed in November 2025, will create the EU's first reimbursement right for impersonation fraud — it is not in force and is expected around 2028.

Netherlands. One narrow exception, and it is worth knowing exactly: if a caller spoofed your own bank's name or number, the banks' voluntary framework says you get 100% back, provided you have filed an aangifte, can evidence the spoofing, and are a private customer. It covers bank impersonation only — not romance, investment or employment fraud. Kifid, the financial services complaints board, ruled in June 2026 that where a customer used their own codes and approved the payments, the bank owes nothing unless it breached its duty of care.

United States. Regulation E does not apply. A wire cannot be recalled as of right — once accepted, cancellation needs the receiving bank to agree. Zelle tells you to report to your bank and not to Zelle, and only "certain imposter scams" qualify for reimbursement, under a network rule rather than a law, whose definition is not published. The federal case against Zelle and three large banks was dismissed with prejudice in March 2025.

What to say

Ring, do not email. Use the words "I have been defrauded" and, if money left by transfer, ask specifically for a recall and a hold harmless letter. Give the date, the amount and the destination account. Ask for a reference number and write down who you spoke to.

Then ask one question and hold them to it: has the receiving bank been contacted, and when. That is the only step with a clock on it.

If they refuse

Every EU bank must handle a complaint internally first. In the Netherlands, after a final answer or eight weeks, Kifid will consider it — within three months of that answer, or a year of first complaining. In the UK, the Financial Ombudsman Service. Elsewhere in the EU, your national supervisor's complaints route and an alternative dispute resolution body, which your bank is obliged to take part in.

None of these are quick. All of them are free.