Unauthorized Transaction vs. Scam Payment: The Difference That Changes Your Next Step

You called your bank. You explained what happened. You used the word “fraud.”

And then the representative said something that stopped you cold: “I'm sorry, but this transaction was authorized.”

You authorized it? You were tricked. How can a scam be “authorized”?

I spent 17 years inside bank fraud investigations, and I can tell you that this single word — authorized — is where most scam victims hit a wall they never saw coming. It's not a technicality. It's the dividing line between two completely different legal frameworks, two different investigation processes, and two very different sets of recovery odds.

Understanding this distinction before you call your bank can mean the difference between a dispute that moves forward and one that gets denied in the first five minutes.

“Start with the payment method, not the story — and learn the words your bank is listening for.”

— Rebecca Harlow

Key Takeaways

• Under Regulation E, an “unauthorized” transaction is one initiated by someone other than you, without your authority, from which you receive no benefit. If you pressed send, the transaction is generally considered authorized — even if you were deceived.

• The CFPB has clarified a critical exception: If a scammer tricks you into sharing your account access information and then uses it to initiate a transfer, that can still qualify as unauthorized.

• Authorized scam payments fall outside mandatory Regulation E reimbursement. Your bank may still reimburse voluntarily, but it is not legally required to.

• Your first sentence to the bank determines which bucket your case lands in. Say “someone accessed my account” if that's what happened. Say “I was tricked into sending it” if that's what happened.

• Both types of loss deserve a report. Filing with the FTC at ReportFraud.ftc.gov creates a record regardless of whether your bank dispute succeeds.

The Definition That Decides Everything

Here is the exact language from the Electronic Fund Transfer Act, as implemented by Regulation E:

“An unauthorized electronic fund transfer means an electronic fund transfer from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit.”

Three elements must all be true for a transaction to be unauthorized:

1. Initiated by a person other than the consumer — someone else pressed the button, not you.

2. Without actual authority — they had no permission to do so.

3. From which the consumer receives no benefit — you got nothing of value.

Now here's the part that catches people: when you're scammed into sending money yourself, you did initiate the transfer. You pressed send. You approved the wire. You gave the gift card numbers. The scammer deceived you, but the mechanics of the transaction were under your control.

The Clearing House, summarizing CFPB guidance, states this directly: “An unauthorized EFT under Regulation E does not include a scenario where a consumer is tricked into making a payment (e.g., as part of a scam) and the consumer instructs their financial institution to make the payment to the fraudster. Such transactions are considered authorized under Regulation E.”

That's the wall. That's why your bank said “authorized.”

The Exception That Changes Everything: Fraudulently Induced Access

But the story doesn't end there. The CFPB has drawn an important line that many consumers — and frankly, many bank representatives — don't fully understand.

The CFPB's FAQs clarify that if a third party fraudulently induces you into sharing your account access information — your login credentials, your debit card number, a one-time code — and then uses that information to initiate a transfer from your account, that transfer can still qualify as unauthorized under Regulation E.

Examples from the CFPB guidance include:

• A scammer calling and pretending to be a bank representative, then tricking you into providing your account login information, a texted confirmation code, or your debit card number

• A scammer using phishing or remote access to observe you entering your login credentials

This is a significant expansion. In plain language: the moment you hand over the keys, you're no longer driving. If the scammer used your credentials to initiate the transfer themselves, you have a Regulation E argument.

But if you initiated the transfer — even after being deceived — you generally don't.

The distinction is not about who was at fault morally. It's about who physically initiated the transaction.

The Two Paths: Side by Side

Here's how the two scenarios compare across the factors that matter most:

The CFPB's own guidance acknowledges this gap. When the CFPB updated its FAQs to clarify that fraudulently induced credential sharing counts as unauthorized, it was described as “a substantial departure from prior interpretations of Regulation E” that “shifts liability to the financial institution.”

But that shift only applies to the credential-sharing scenario. If you authorized the payment yourself, you're in a different territory.

Scenario Analysis: Which One Are You?

Let's walk through four real-world scenarios. Find the one that matches what happened to you.

Scenario 1: The Fake Bank Fraud Alert

What happened: You receive a text that looks like it's from your bank. It says there's suspicious activity on your account and asks you to verify by logging in through a provided link. You enter your username and password. The scammer now has your credentials, logs in from a different device, and transfers $3,000 out of your account.

Classification: Unauthorized transaction.

Why: You shared your access information because you were fraudulently induced. The scammer used that information to initiate the transfer without your authority. This fits the CFPB's clarified definition of unauthorized EFT.

What to say to your bank: “I was tricked into providing my login credentials through a phishing message. The scammer then used those credentials to initiate a transfer from my account without my authorization.”

Scenario 2: The “Safe Account” Transfer

What happened: Someone calls claiming to be from your bank's fraud department. They say your account has been compromised and you need to move your money to a “safe account” they've set up for you. They stay on the phone while you log into your banking app and transfer $8,000 to the account number they provide. You initiate the transfer yourself.

Classification: Authorized scam payment.

Why: You initiated the transfer. You pressed send. The scammer deceived you about the purpose, but the transaction itself was under your control. This falls outside Regulation E's mandatory unauthorized transaction protections.

What to say to your bank: Be honest about what happened. “I was contacted by someone impersonating my bank and instructed to transfer funds to a ‘safe account.' I initiated the transfer myself based on their deception.” Then ask: “Do you have a scam reimbursement policy for authorized push payment fraud?” The answer varies by institution.

Scenario 3: The Remote Access Trap

What happened: A pop-up on your computer says you have a virus and provides a phone number to call. The “technician” asks to remotely access your computer to fix the problem. While connected, they open your banking website (where you're already logged in) and initiate a transfer to an account you don't recognize.

Classification: Unauthorized transaction.

Why: The scammer initiated the transfer using your already-open session. You did not press send. Under the CFPB's guidance, this parallels the phishing scenario — the scammer used access to your device to initiate the transfer.

What to say to your bank: “Someone gained remote access to my computer and initiated a transfer from my account without my authorization. I did not approve or initiate this transaction.”

Scenario 4: The Romance Scam “Investment”

What happened: Over several weeks, someone you met online builds a relationship with you and introduces you to a “cryptocurrency investment platform.” You believe you're investing. You send $12,000 through multiple wire transfers to the platform. Later, you discover the platform is fake.

Classification: Authorized scam payment.

Why: You initiated every transfer. You authorized each wire. The deception was about the purpose of the payment, not about who was initiating it. This falls outside Regulation E protections entirely.

What to say to your bank: Report the transfers and request a wire recall if recent enough. Ask about any scam reimbursement policies. File with the FTC and IC3. Recovery odds are low, but the report matters.

Why Banks Classify It This Way

You might be thinking: “But I was tricked. The scammer is the criminal. Why does it matter who pressed the button?”

From a legal and regulatory standpoint, it matters because Regulation E's consumer protections are built around the concept of unauthorized access, not deception. The regulation assumes that if you authorize a payment, you've made a decision — even if that decision was based on bad information.

The CFPB has acknowledged the gap. As of 2026, there is still no federal mandate requiring banks to reimburse consumers for authorized push payment (APP) fraud. Some banks have voluntary policies for qualifying impostor scams. Others don't.

The UK and EU have moved toward mandatory reimbursement for APP fraud, but the United States has not followed suit. Under the EU's PSD3 framework, mandatory reimbursement for APP scams is being introduced for impersonation fraud when the user reports promptly. In the UK, the Payment Systems Regulator introduced mandatory reimbursement in October 2024, splitting liability between sending and receiving institutions.

In the U.S., the landscape remains a patchwork of bank policies, voluntary guidelines, and state-level variations.

What This Means for Your Next Call

Now that you understand the distinction, here's how to use it.

Step 1: Identify which category your situation falls into.

Ask yourself: Did I press send, or did the scammer press send?

If you shared login credentials and the scammer used them to move money: unauthorized.
If you initiated the transfer yourself after being deceived: authorized scam payment.

If you're not sure — for example, if you gave remote access and the scammer took over your session — lean toward describing the mechanics accurately and let the bank investigate.

Step 2: Use precise language when you call.

The words you use signal to the bank which process to follow. Here's a comparison:

Step 3: For unauthorized transactions, know your rights.

If your situation qualifies as unauthorized under Regulation E:

• Your liability is capped at $50 if you report within 2 business days

• Your liability is capped at $500 if you report within 60 days of the statement showing the error

• After 60 days, your liability may be unlimited

If the bank can't resolve your dispute within 10 business days, it must provide provisional credit while the investigation continues.

The bank cannot use your negligence — like writing your PIN on your card — to impose greater liability than Regulation E allows. It also cannot require you to file a police report before starting its investigation.

Step 4: For authorized scam payments, ask the right questions.

If your situation falls outside Regulation E mandatory coverage:

• Ask directly: “Does this bank have a scam reimbursement policy for authorized push payment fraud?” Some banks do, even though they're not required to.

• Ask: “Is there an escalation path or a specialized fraud review team that handles scam cases?”

• Request written confirmation of the denial. You may need it for a CFPB complaint or state attorney general inquiry.

• File a complaint with the CFPB at consumerfinance.gov/complaint if you believe the bank mishandled your case.

The Gray Zone: Where Classification Gets Messy

Not every case fits neatly into one category. Here are the situations that require more careful analysis.

You gave the scammer a one-time code. If you received a code via text and read it to the scammer, who then used it to authorize a transfer — is that unauthorized? The CFPB's guidance suggests that if the scammer used your credentials to initiate the transfer, it may still be unauthorized. But the scammer will argue you gave them the code voluntarily. The key question: who initiated the transaction? If the scammer was already logged in and needed the code to complete their transfer, it leans unauthorized. If you were on the phone with a fake “bank representative” who walked you through a transfer you performed yourself, it leans authorized.

You were coached through the transfer. Scammers often stay on the phone and guide victims step by step through the process of sending money. You pressed the buttons, but you were following instructions. This is generally treated as authorized, because you had physical control of the device and performed the actions. But the coercion element may be relevant to your bank's voluntary review.

The scammer added themselves as a payee on your account. If the scammer gained access to your account (through stolen credentials) and added themselves as a payee, then initiated a transfer to that payee — that's unauthorized. You didn't add the payee and you didn't initiate the transfer.

You used a payment app linked to your bank account. When you link a payment app to your bank account, the app may pull funds directly. If a scammer tricks you into sending money through the app, the transaction may be classified as authorized — you initiated it through the app. But if the scammer accessed your app account and initiated the transfer, it may be unauthorized. The CFPB has clarified that P2P transfers using a debit card or debiting a deposit account are covered by Regulation E.