"I Approved the Payment" Doesn't End Your Fraud Claim

Former bank fraud investigator Rebecca Harlow explains that under Regulation E § 1005.2(m), a transfer is "unauthorized" only if initiated by someone else without authority — and the CFPB says fraudulently induced credential sharing can qualify, so a denial letter saying "you authorized this transaction" may signal an incomplete investigation rather than a legal conclusion.

The denial letter said it in six words: "You authorized this transaction."

You read it and felt the floor drop. Because you did press send. You did approve the transfer. You did read the code to the person on the phone. So doesn't that settle it? Doesn't "I approved it" mean the bank is right, the case is closed, and you have no one to blame but yourself?

No. And the reason why is one of the most misunderstood — and most consequential — distinctions in consumer fraud law.

I spent 17 years inside bank fraud investigations. I have written denial letters that used that exact language. I have also seen claims reversed on appeal because the investigator never asked the right question: who actually initiated the transaction, and how did they get the access they used?

"I approved the payment" answers the first half of a question. It does not answer the second half. And under federal law, the second half is often what determines whether you have protections at all.

"The words your bank uses are not the end of the analysis. They are the beginning of yours."

— Rebecca Harlow

Key Takeaways

"Authorized" is a legal term of art, not a moral judgment. Under Regulation E, a transaction is unauthorized if it was initiated by someone other than you, without your authority, and from which you received no benefit.
The CFPB has clarified that fraudulently induced credential sharing can qualify as unauthorized. If a scammer tricks you into providing your login information, a one-time code, or your debit card number, and then uses that information to initiate a transfer, that transfer may be unauthorized under Regulation E.
Banks often use "authorized" as a shortcut. A denial letter that says "you authorized this transaction" without explaining how the bank reached that conclusion may reflect an incomplete investigation, not a legal conclusion.
Your negligence does not strip your protections for unauthorized transfers. Regulation E explicitly states that consumer negligence — like writing your PIN on your card — cannot be used to impose greater liability than the regulation allows.
You have the right to the bank's investigation file. Under Regulation E, when a bank denies an error claim, it must provide a written explanation and copies of the documents it relied on.

What "Authorized" Actually Means Under the Law

Man in hallway reading one-time code from phone to caller.

The word "authorized" feels intuitive. You either gave permission or you didn't. But in the context of the Electronic Fund Transfer Act and Regulation E, the term has a specific definition that is narrower than everyday usage.

Regulation E § 1005.2(m) defines an unauthorized electronic fund transfer as:

"An electronic fund transfer from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit."

Three elements must all be present:

Initiated by a person other than the consumer. Someone else pressed the button — not you.
Without actual authority. They had no permission to do so.
From which the consumer receives no benefit. You got nothing of value.

Now look at the third element carefully. In most scams, you receive no benefit. The scammer takes your money and gives you nothing. So that element is usually satisfied. The fight is almost always about the first two.

Who initiated the transfer? If you pressed send yourself, the bank will say you initiated it. If someone else used your credentials or access to initiate the transfer, you have a stronger argument.

Did they have actual authority? If you were tricked into giving them access, they did not have actual authority — they had fraudulently obtained access.

This is where the CFPB's guidance becomes critical.

The CFPB's Clarification: Fraudulently Induced Access

In its Electronic Fund Transfers FAQs, the CFPB addressed a scenario that banks had been using to deny claims for years: what happens when a scammer tricks you into sharing your account access information, and then uses that information to initiate a transfer?

The CFPB's answer: that transfer can qualify as unauthorized under Regulation E.

The Clearing House's summary of the CFPB FAQ states: "An 'Unauthorized EFT' includes an EFT stemming from a situation where a consumer is fraudulently induced by a third party into sharing account access information and the third party initiates a transfer from the consumer's account."

The CFPB's examples are specific and familiar:

A third party calling the consumer and pretending to be a representative from the consumer's financial institution, then tricking the consumer into providing their account login information, a texted confirmation code, or debit card number.
A third party using phishing or other methods to gain access to a consumer's computer and observe the consumer entering account login information.

This is not a narrow exception. It is a significant expansion of what counts as "unauthorized," and it directly contradicts the way many banks have been trained to classify scam cases.

The CFPB's reasoning is grounded in Regulation E commentary 1005.2(m)-3, which states: "An unauthorized EFT includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery."

Read that again: obtained through fraud. If the scammer obtained your access device — your login credentials, your card number, your one-time code — through fraud, and then used it to initiate a transfer, that transfer is unauthorized.

The Line That Still Matters: Who Pressed Send?

Here is the part that many scam victims misunderstand, and that many banks use to deny claims that should be approved.

The CFPB's clarification applies to situations where the third party initiates the transfer using fraudulently obtained access. It does not apply to situations where you initiate the transfer yourself after being deceived.

The Clearing House summary is explicit on this point: "An unauthorized EFT under Regulation E does not include a scenario where a consumer is tricked into making a payment (e.g., as part of a scam) and the consumer instructs their financial institution to make the payment to the fraudster. Such transactions are considered authorized under Regulation E because the consumer authorized their FI to make the payment."

So the question is not "were you deceived?" The question is "who initiated the transfer?"

Scenario	Who Initiated?	Classification
Scammer logs into your account with stolen credentials and sends money	Scammer	Unauthorized — Regulation E applies
Scammer calls, claims to be your bank, tricks you into reading a one-time code, then uses it to log in and send money	Scammer	Unauthorized — Regulation E applies
Scammer calls, claims to be your bank, tells you to log in and transfer money to a "safe account" — you do it yourself	You	Authorized — Regulation E protections generally do not apply
Scammer sends a phishing link, you enter your login credentials on a fake site, then the scammer logs in and sends money	Scammer	Unauthorized — Regulation E applies

The distinction is mechanical, not moral. The law asks who physically initiated the transaction, not who was at fault.

But here is why this distinction is being challenged — and why banks are losing.

Why Banks Rely on "Authorized" — and Why It's Being Challenged

Banks have strong incentives to classify scam payments as "authorized."

If a transaction is authorized, Regulation E's error resolution procedures do not apply. The bank does not have to investigate, does not have to provide provisional credit, and does not have to reimburse you. The loss stays with you.

If a transaction is unauthorized, the bank must investigate, must provide provisional credit if the investigation extends beyond 10 business days, and must comply with liability caps that limit your exposure to $50 or $500 depending on how quickly you report.

The financial difference between those two classifications is enormous. And banks know it.

This is why the CFPB's Zelle lawsuit mattered. In December 2024, the CFPB sued Zelle's operator and three major banks, alleging they failed to protect consumers from fraud on the platform. A critical issue in the case was the CFPB's view that banks should be required to reimburse customers for what it called "induced fraud" — when a consumer is tricked into sending money to someone under false pretenses.

The CFPB dismissed that lawsuit in March 2025. But the legal fight is not over. A separate case from the New York Attorney General is moving forward, alleging that Zelle's setup allowed fraudsters to steal more than $1 billion from users between 2017 and 2023.

The banks' position is consistent: if the consumer authorized the payment, the bank is not responsible. The consumer's position — supported by the CFPB's FAQ — is that when the scammer obtained access through fraud, the resulting transfer should be treated as unauthorized regardless of who pressed the final button.

How Banks Investigate — and Where They Fall Short

When a bank investigates a fraud claim, it is required to conduct a reasonable investigation. But "reasonable" is not defined by the regulation in precise terms, and many banks have developed shortcuts.

Here is what a thorough investigation should include:

Login and device analysis. Did the transfer originate from a device or IP address you normally use? If the scammer logged in from a different location, that is evidence of unauthorized access.
Timing analysis. How soon after the scammer contacted you did the transfer occur? A transfer made while you were on the phone with a scammer tells a different story than a transfer made days later.
Communication review. Did you report the fraud promptly? Did you provide screenshots, call logs, or a written timeline?
Access credential analysis. Did you share your login information? Did you read a one-time code to someone? Did you enter credentials on a site that turned out to be fake?

Many investigations skip these steps. The investigator sees that you initiated the transfer — or that you shared credentials — and classifies the case as "authorized" without digging into the mechanics.

That is where the denial letter comes from. And that is where your appeal begins.