Reg E Disputes: What Merchants Need to Know About Regulation E

A Reg E dispute is a consumer's claim to their bank that an electronic payment was unauthorized or wrong. Regulation E sets the bank's deadlines. It does not bind you, the merchant. But the claim can still reach you as a debit card chargeback or an ACH return.

What Is Reg E?

Reg E, or Regulation E, is the federal rule that puts the Electronic Fund Transfer Act (EFTA) into practice. It lives at 12 CFR Part 1005, and the Consumer Financial Protection Bureau (CFPB) maintains it. In banking, Reg E is the reason a customer can report a strange debit and get a fast answer.

It covers any transfer “initiated through an electronic terminal, telephone, computer, or magnetic tape” (12 CFR 1005.3(b)(1)). The transfer must order a bank to debit or credit a consumer's account. The rule has three main jobs:

• Cap what a consumer loses to unauthorized transfers.
• Force banks to investigate errors on a fixed clock.
• Require disclosures, receipts and periodic statements.

So what is a Reg E dispute? It is the error notice a consumer gives their bank under section 1005.11. The bank, not the merchant, must answer it.

What Does Regulation E Cover, and What Does It Not?

Regulation E covers electronic money movement into and out of consumer accounts. It does not cover credit cards, paper checks or business accounts.

The account test is the key filter. Regulation E banking protections apply to “a demand deposit (checking), savings, or other consumer asset account” held “primarily for personal, family, or household purposes” (12 CFR 1005.2(b)(1)). A “consumer” is “a natural person.”

What Counts as an Error Under Reg E?

Reg E lists seven kinds of error in 12 CFR 1005.11(a). A Reg E claim must fit one of them:

• An unauthorized electronic fund transfer.
• An incorrect transfer to or from the consumer's account.
• A transfer left off the periodic statement.
• A computational or bookkeeping error by the bank.
• The wrong amount of money from an ATM or other terminal.
• A transfer that is not identified as the rule requires.
• A request for documents or more information about a transfer.

A routine balance inquiry is not an error. Neither is a document request made for tax or record-keeping reasons. For merchants, the first two types matter most. They become fraud chargebacks and wrong-amount chargebacks.

Does Reg E Apply to Business Accounts?

No. Reg E does not apply to business accounts. An account set up mainly for business use fails the consumer account test above, even if one person owns the business.

That does not leave business payments without dispute rights. Two other rule sets take over:

• Card network rules. Visa and Mastercard chargeback rules apply to business debit and credit cards too.
• Nacha rules. Unauthorized ACH debits on business accounts can be returned, but the window is short: about two banking days, per Stripe's ACH documentation.

For a merchant that sells B2B, this matters. A business buyer has far less time to claw back an ACH debit than a consumer does.

How Much Can a Consumer Lose to an Unauthorized Transfer?

It depends on how fast they report it. Section 1005.6 sets three tiers (12 CFR 1005.6(b)):

Banks must stretch these windows “to a reasonable period” for extenuating circumstances, such as a hospital stay. The CFPB also says negligence “cannot be used as the basis for imposing greater liability.” A PIN written on the card does not raise the cap.

Here is why this matters to you. The consumer usually has little at stake. So they have every reason to file, and their bank has a legal duty to act fast.

How Long Does a Bank Have to Resolve a Reg E Dispute?

The bank has 10 business days to decide, or it must provisionally credit the customer and can then take up to 45 days. Some transfers get 90 days. This is the full Reg E timeline in 12 CFR 1005.11, with the event that starts each clock.

One exception helps banks. If the consumer called in the error, the bank can ask for written confirmation within 10 business days. Without it, provisional credit is not required.

What Does CFPB Guidance Say About P2P and Fraud-Induced Transfers?

The CFPB's Regulation E FAQs (last updated January 15, 2025) read the rule broadly for P2P and scams:

• “Any P2P payment that meets the definition of EFT is covered by EFTA and Regulation E.”
• A transfer a fraudster starts through a P2P app is unauthorized, even if the consumer has no account with that app.
• A consumer tricked into sharing login details has not “furnished an access device,” so the resulting transfer is unauthorized.
• A bank may not make the consumer contact the merchant or file a police report before it investigates.

The FAQs were still posted on November 10, 2026. They are separate from the January 2025 proposal on emerging payment methods, which the CFPB withdrew on May 15, 2025.

There is a limit. Reg E defines an unauthorized transfer as one “initiated by a person other than the consumer.” If your customer sent the money themselves, even to a scammer, it is generally not unauthorized. Most of those scams are social engineering fraud.

That gap matters in Zelle disputes and in some Chime disputes. It also shapes the refund tradeoffs of pay by bank.

How Does a Reg E Claim Reach a Merchant?

A Reg E claim reaches you through the payment rail, not through Reg E itself. The bank owes its customer an answer. To recover the money, it uses the rules of the network the payment ran on.

Debit card payments. The issuer files a chargeback under Visa or Mastercard rules. Cardholders generally have 120 days, and your processor usually gives you 7 to 21 days to respond (Stripe disputes docs). See chargeback time limits by network. Payments routed over PINless debit networks follow that network's own dispute rules.

ACH debits. The customer's bank returns the entry. R10 means the customer does not know or did not authorize the originator. R11 means an authorization exists but the entry did not match it, such as a wrong amount or date.

Both codes need the customer's Written Statement of Unauthorized Debit. The return window is 60 days (Nacha). Read more on ACH chargebacks and ACH return codes.

The big difference: a timely consumer ACH return is final in the ACH network. You cannot submit evidence to reverse it. With R11, you may fix the error and send a new entry within 60 days of the return's settlement date, without a new authorization. For R10, you need to resolve it with the customer.

What changed in 2026 for ACH. Nacha now requires business originators to run risk-based processes that spot ACH entries initiated due to fraud, and to review them each year.

The rule took effect on March 20, 2026 for originators with 6 million or more ACH entries in 2023. It reached all other business originators on June 19, 2026. For debits, Nacha says strong return and return rate monitoring meets the minimum. So track your R10 and R11 returns by customer and by product.

Reg E vs Reg Z vs Network Chargebacks vs Nacha Returns

Four clocks can run on one disputed payment. Only two of them give you a say.

Sources: 12 CFR 1005.11, 12 CFR 1026.13, Stripe and Nacha as linked above.

Why Can the Bank Credit Your Customer Before You Respond?

Because the bank's Reg E clock is shorter than your chargeback window and starts earlier. If the bank cannot finish in 10 business days, it must put the money back in the customer's account. That is provisional credit, and it comes from the bank, not yet from you.

The bank then seeks the funds through a chargeback. Your evidence lands in a review the bank started days before. And since the bank cannot require the customer to call you first, you may get no warning. This is how banks process disputes in practice.

Should you fight or accept? Use the payment rail and your evidence to decide.

For card payments, you can sometimes stop the chargeback before it lands. Chargeback alerts flag a dispute early, so you can refund it before it counts against you. Alerts do not cover ACH returns.

{{cta}}

How Does a Debit Card Dispute Move Through Reg E and Chargeback Rules?

A debit card dispute runs on two clocks at once: the bank's Reg E clock and the network's chargeback clock. Illustrative example (hypothetical figures). A customer buys a $240 jacket online with a consumer debit card. The order ships with tracking and is delivered.

The lesson: your evidence helps the bank close its Reg E file. A strong packet can lead the bank to find no error at all.

What Evidence Helps in a Debit Dispute Tied to a Reg E Claim?

Match your evidence to the claim. The customer's words to their bank set the reason code, and the reason code sets what counts. For a full playbook, see how to win a debit card chargeback.

For Visa card-absent fraud disputes (condition 10.4), Compelling Evidence 3.0 can help. It needs two undisputed prior transactions from 120 to 365 days earlier, with two matching data elements, one of them IP address or device ID.

How Is a Reg E Dispute Different From a Credit Card Dispute?

Reg E covers debit and bank transfers. Regulation Z covers credit cards. The main differences:

• Liability. Reg Z caps unauthorized credit card use at the lesser of $50 or the amount taken. Reg E uses the $50, $500 and unlimited tiers.
• Money during review. Under Reg Z, the cardholder does not have to pay the disputed amount while it is reviewed. Under Reg E, the money has already left their account, so provisional credit is the remedy.
• Scope. Reg Z billing errors include goods not delivered as agreed. Reg E errors focus on the transfer itself, so debit “item not received” claims rely mostly on network rules.

For merchants, the chargeback path looks almost the same for both. The deadlines that bind you come from the network and your processor. Compare a credit card dispute vs debit card dispute for the response side. For the issuer and acquirer roles in a bank chargeback, see our banking guide.

Which Rule Applies to This Payment?

Reg E Protects Your Customer, but Network Rules Decide Your Case

Reg E tells the bank how to treat its customer. It does not decide whether you keep the sale. That happens under card network or Nacha rules, on their deadlines. Learn what a chargeback is, keep proof for every debit order, and respond inside your processor's window.

{{cta}}

Veelgestelde vragen

What is Reg E?

Reg E is Regulation E, the CFPB rule that implements the Electronic Fund Transfer Act. It protects consumers who use debit cards, ATMs, ACH, direct deposit and qualifying P2P payments.

What is a Reg E dispute?

A Reg E dispute is a consumer's notice to their bank that an electronic transfer was unauthorized or wrong. The bank must investigate under 12 CFR 1005.11.

How many days does a bank have for a Reg E dispute?

The bank has 10 business days to decide. If it provisionally credits the customer, it can take up to 45 days. The limit is 90 days for point of sale debit, transfers not started in a state, and transfers within 30 days of the first deposit.

Does Reg E apply to business accounts?

No. Reg E covers only accounts held mainly for personal, family or household purposes. Business accounts rely on card network rules, Nacha rules and the account agreement.

Does Reg E apply to credit cards?

No. Credit card disputes fall under Regulation Z, which has its own 60 day notice window and 90 day maximum resolution time.

Can a merchant fight a Reg E claim?

Not the Reg E claim itself, since it runs between the bank and its customer. You can fight the resulting card chargeback with evidence. A timely consumer ACH return cannot be reversed in the ACH network.

Does Reg E cover prepaid cards?

Yes. Since the CFPB's prepaid rule, the definition of account includes prepaid accounts, payroll card accounts and government benefit accounts (12 CFR 1005.2(b)(3)). A gift card usable at only one merchant is not a prepaid account.

Are P2P payments covered by Reg E?

Yes, when they meet the electronic fund transfer definition. Transfers a fraudster starts are unauthorized. Payments the consumer sends themselves, even to a scammer, generally are not.

What errors does Reg E cover?

Reg E covers seven error types. They include unauthorized transfers, incorrect transfers, transfers missing from a statement, bank bookkeeping errors and wrong ATM amounts. Balance inquiries and routine document requests are not errors.

Last reviewed: November 10, 2026.