Card, bank transfer or app: how the way you paid decides whether you get money back

Two people can lose the same amount to the same scam and have very different outcomes. One gets a refund. The other is told the money is gone. The difference is often not how careful they were. It is the payment method, and whether the law treats the payment as one the customer made or one a criminal took.

The FTC reported that in 2024 people reported losing more to scams paid by bank transfer or cryptocurrency than to all other payment methods combined. That is the pattern this post explains. It is general explanation, not legal or financial advice, and the rules differ by country and by card issuer.

The question underneath: who made the payment

Most written protections turn on one distinction. In an unauthorised payment, someone else initiated it without your authority. In an authorised payment, you made it yourself, even though you were deceived about why. The UK regulator draws the same line between unauthorised fraud and what it calls authorised push payment fraud. Our glossary entry on APP fraud explains the term.

When a scammer persuades you to send the money, the payment is one you made yourself. That is why the written rules often help less than people expect.

Credit cards (US)

The FTC’s advice is to report to the card issuer immediately and ask for a refund, whether someone used your card without authorisation or a scammer tricked you into paying. Two federal rules sit behind that.

For unauthorised use, Regulation Z limits a cardholder’s liability to the lesser of $50 or the value obtained before the issuer is told. For billing errors, the rule (which implements 15 U.S.C. 1666) defines an error to include a charge not made by you or someone with authority, and a charge for services “not delivered to the consumer … as agreed”. You must give written notice within 60 days of the first statement showing the error. The issuer must acknowledge within 30 days and resolve it within two billing cycles, and you need not pay the disputed amount meanwhile.

Whether a given scam payment fits those definitions depends on the facts. We found no federal text saying a card payment you were tricked into making is automatically a billing error. Card networks also have their own dispute rules, which we could not read directly. A UK Financial Ombudsman decision describes a 120-calendar-day limit under Visa’s rules for raising a chargeback on a debit card payment. Our chargeback entry covers the route.

Debit cards and electronic transfers (US)

Regulation E covers electronic fund transfers from a consumer’s account. It defines an unauthorised transfer as one “initiated by a person other than the consumer without actual authority”. Liability is capped at $50 if you report within two business days of learning of a lost or stolen access device, and at $500 after that, with a 60-day rule for transfers shown on a statement. The bank generally has 10 business days to investigate, or up to 45 days if it provisionally credits your account.

The CFPB’s 2021 FAQ says that when a third party fraudulently induces you to share account access information and then uses it to take money, that is an unauthorised transfer. Its examples are a caller posing as your bank who obtains your login or texted code.

That is the limit. The rule text covers transfers initiated by someone other than you. We found no federal text that guarantees a refund of a payment you initiated yourself while deceived, whether by debit card, bank transfer or Zelle. The FTC still tells people to report such payments to their bank and ask it to reverse them. That is advice to ask, not a described legal right.

Payment apps, wires, gift cards and crypto

The FTC’s page gives the same short instruction for each: report it to the app, the wire transfer company, the gift card issuer or the exchange or crypto ATM operator immediately, say you were tricked, and ask for a refund.

On cryptocurrency it adds that these payments “don’t have the same legal protections as credit and debit cards do, so it can be hard to get your money back”, though some states have passed laws that might help. Regulation E also excludes wire systems of the Fedwire kind, as our post on wire recall explains. For gift cards the FTC advises keeping the card and the receipt.

For each of these we found no federal text that gives a right to a refund once you have authorised the payment. What exists is a request, and the sooner it is made the better.

The United Kingdom

The UK has gone furthest in writing a refund right for authorised payments. Since 7 October 2024, the Payment Systems Regulator’s rules require reimbursement for authorised push payment fraud over Faster Payments and CHAPS, the UK bank transfer systems.

• It covers individuals, microenterprises and charities.
• Report within 13 months. Reimbursement is due within five business days, extendable to 35 business days if the firm needs more information.
• The maximum is £85,000. Firms may apply an optional excess of up to £100, but not to vulnerable customers.
• There is no refund if you were complicit or grossly negligent, which the regulator calls a high bar that does not apply to vulnerable consumers.
• Above £85,000, the Financial Ombudsman Service can look at your case.

Card, cash and cheque payments are outside it and have “their own protections”. For credit cards, section 75 of the Consumer Credit Act 1974 makes the card provider jointly liable with the supplier for misrepresentation or breach of contract, for a single item with a cash price between £100 and £30,000. Whether a scam amounts to a claim of that kind is again a question of facts. See the UK’s authorised push payment figures and our UK reporting page.

Australia

Australia is in transition. Scamwatch’s advice is to contact your bank or card provider immediately and ask them to stop any transactions, and to complain to the Australian Financial Complaints Authority if you are unhappy with the response. The new Scams Prevention Framework places duties on banks, telecommunications providers and digital platforms to prevent, detect, disrupt, report and respond to scams. ASIC says covered firms must be AFCA members by 1 September 2026 and that most obligations start on 31 March 2027. The pages we read describe duties on firms and a free dispute route. They do not describe a refund right for a payment you authorised. See our Australia page.

What this means in practice

Use the method with the strongest written protection where you have a choice. And if you have already paid, contact the provider at once, because every rule above runs on a clock. Our related facts page shows the US bank transfer figures.