Provisional Credit, Explained: When Your Bank Must Refund You — and When It Can Take It Back

A provisional credit is a temporary credit your bank puts in your account so that it can take longer to investigate. It is the price of a deadline extension, not a decision in your favor — and the bank can take it back if it concludes that no error occurred.

• If your bank cannot finish investigating within the short deadline, the credit is generally required, not optional.
• It can be reversed — and when it is, the regulation gives you a short window of protection against the fees that would otherwise follow.
• If someone took money without your involvement, the rules are on your side. If you were deceived into sending it yourself, generally they are not.
• Report it fast. The amount you can be held liable for is driven almost entirely by how quickly you speak up.

Jump to the calculator to turn your own dates into the deadlines your bank is working to.

• You are waiting to hear back. The deadlines and what starts each one are in what a provisional credit actually is.
• The credit appeared, and then it vanished. What that means and what protection attaches is in why it was reversed.
• They have told you no. The steps that are still open to you are in when the bank says no.

Here is what the bank must do, by when, what it is allowed to take back, and what is left when it says no.

1. Which rule covers your money

The rules in this article come from the Electronic Fund Transfer Act and its implementing regulation, Regulation E at 12 CFR Part 1005. They apply to electronic fund transfers that debit or credit a consumer’s account. That covers debit card transactions, ACH debits, and instant account-to-account transfers out of an ordinary checking or savings account.

Start with the exclusion that matters most, because it decides whether the rest of this page applies to you. A wire transfer is generally not covered. Regulation E excludes transfers through Fedwire and similar wire transfer systems. Domestic wires are generally governed instead by Article 4A of the Uniform Commercial Code as adopted by your state, a framework built around bank-to-bank payment orders and security procedures rather than around consumer refund deadlines. The practical consequence is direct: the ten-business-day investigation window, the forty-five-day extension and the provisional-credit requirement described here do not apply to a wire. Some courts have looked at the edges of that boundary for wires a consumer starts inside an online banking app, so the line is not perfectly settled, but the general position is the one to plan around.

Checks are also outside it. A transfer originated by check is excluded from the definition of an electronic fund transfer, so check fraud follows a different body of law.

A credit card charge follows a different statute again — the Truth in Lending Act and Regulation Z — with its own deadlines and its own liability cap. That regime is more generous to the cardholder in several respects, which is exactly why a debit dispute can feel worse than a card dispute for the same amount of money: with a card, the money in dispute was the issuer’s; with a debit, the money that left was yours. We cover the card side separately in Unauthorized Credit Card Charges: Your Liability & Next Steps.

Transfers you send to a recipient in another country generally fall under a separate part of the same regulation covering remittance transfers, which has its own disclosure, cancellation and error-resolution rules.

Finally, one clause on business accounts: Regulation E applies to accounts held primarily for personal, family or household purposes, so an account held for business purposes is outside this regime and is governed by the account agreement and state law instead.

2. Reporting it: the clock and what starts it

Your reporting clock runs from the day the statement was sent, not from the day of the transaction. Under 12 CFR 1005.11(b)(1), the institution must follow the error-resolution procedure for a notice of error it receives no later than 60 days after it sends the periodic statement on which the error first appears. Almost every page that gets this wrong writes “60 days from the transaction.” A transfer made on the third of a month may not appear on a statement sent until the first of the next one — which can move the closing date by weeks in your favor.

The notice does not have to be a formal document. Under the same paragraph it must let the institution identify your name and account number, and it must say why you believe an error exists, including — to the extent you can — the type, date and amount of it. That is the whole legal requirement.

Oral notice counts. But there is a trap in the next paragraph: the institution may require you to confirm an oral notice in writing within 10 business days, and if it requires that confirmation and does not receive it, it is not obliged to give you a provisional credit. If it imposes that requirement, it must tell you so and give you the address to send it to at the time you give the oral notice. Ask at the outset whether they require written confirmation, and send it anyway. It costs you nothing and it removes one of only two express escape hatches from the credit duty.

Two sentences on the other route that exists for card transactions, because people mix them up: a card chargeback runs through the card networks under their own rules and timetables, and it is a different process from the bank error-resolution claim described here, with different deadlines. We cover it in How to Dispute a Credit Card Charge and Get Your Money Back.

Speed matters for a second reason that has nothing to do with the investigation: it changes the maximum amount you can be held responsible for. That is section 5.

3. What a provisional credit actually is

A provisional credit is a temporary credit an institution places in your account for the amount of the error you reported, while it continues investigating. It appears on your statement like a refund. It is not one yet.

When it is required rather than optional

It is required whenever the institution wants the extended investigation period. If it finishes inside 10 business days, no credit is needed. If it needs longer and wants the protection of paragraph (c)(2), it must credit you within those 10 business days. Bank help pages describe this as something they “may” do. In the rule it is a condition, not a courtesy.

How much it must be for

The full amount of the alleged error, including interest where applicable. There is one narrow deduction, described below.

When it must appear

Within 10 business days of the institution receiving your notice of error — or 20 business days if the transfer happened within 30 days after the first deposit to the account.

When they must tell you about it

Within two business days after making the credit, the institution must inform you of the amount and the date of it.

Whether you can spend it

Legally, yes — the rule requires that you be given full use of the funds during the investigation. Practically, treat that as a right you should be slow to exercise. The money is spendable and reversible at the same time. If the investigation concludes against you, the credit comes back out, and it comes out of whatever balance is there on that day.

The amount they may hold back, and when

An institution may withhold a maximum of $50 from the provisional credit, but only in a specific circumstance: it must have a reasonable basis for believing that an unauthorized electronic fund transfer occurred, and it must have satisfied the disclosure conditions in 12 CFR 1005.6(a). That $50 tracks the first tier of the liability limits in section 5.

The two situations in which no credit is required

There are exactly two in the rule. The first: the institution required written confirmation of your oral notice and did not receive it within 10 business days. The second: the account is one subject to the Federal Reserve Board’s Regulation T, which governs securities credit extended by brokers and dealers. An institution relying on either exception still has to comply with everything else in the error-resolution section — it still has to investigate, still has to report results, still has to explain a denial.

The accounts and transactions that get longer periods instead

Two extensions exist, and they do different jobs. The first replaces 10 business days with 20 business days, and it applies only to transfers occurring within 30 days after the first deposit to a new account. The second replaces the 45-day outer limit with 90 days, and it applies to three categories: transfers not initiated within a state, point-of-sale debit card transactions, and transfers within 30 days after the first deposit. Note what this means for a point-of-sale debit card claim: the investigation can run to 90 days, but the provisional credit is still due within 10 business days. Competing pages write “sometimes 90 days” and stop. The trigger is the point.

Everything above resolves into one of two states, and knowing which one you are in tells you what happens next.

• FINAL — what cannot be clawed back. A correction made after the institution determines that an error occurred.
• FINAL. A provisional credit that the institution has notified you has been made final at the end of its investigation.
• FINAL. The institution’s obligation to give you a written explanation once it finds no error, and your right to ask for the documents behind it.
• FINAL. The 60-day reporting window itself: once it closes, it does not reopen, though a late notice does not necessarily end the matter.

• PROVISIONAL — what can still be reversed. A credit issued so the institution could extend its investigation, before it has reported any result to you.
• PROVISIONAL. Any balance in the account that includes that credit. A reversal comes out of whatever is there on the day.
• PROVISIONAL. Money you have already spent from the credit. Spending it does not make it yours.
• PROVISIONAL. Anything the institution has told you verbally but has not reported to you as a completed result.

4. Why it was reversed

Because the investigation finished and the institution determined that no error occurred. When that happens, 12 CFR 1005.11(d) lets it debit the provisionally credited amount back out of your account. The credit was always conditional on the outcome; the outcome went the other way.

The rule does not let it happen silently. Upon debiting the amount, the institution must notify you of the date and the amount of the debiting. Separately, its report of the results must include a written explanation of its findings, and it must tell you that you have the right to request the documents it relied on in reaching that determination.

If you had already spent the credit, the reversal can push the balance below zero, and once those five business days close the ordinary fee machinery resumes. That is a fee problem rather than a dispute problem, and it is worth treating as its own task — our guide to How to Get Overdraft Fees Refunded covers the request. What matters here is the sequencing: deal with the protected window first, because it is a rule the institution has to follow, and deal with the fees that fall outside it second, because those are a request.

Requesting the documents they relied on

This is the highest-value step available to you after a denial, and it is buried on nearly every page that discusses this subject. The rule is explicit: the written explanation must note your right to request the documents the institution relied on in making its determination, and upon request the institution must promptly provide copies. Ask in writing. Ask specifically — the transaction records, the device or session data, the authentication records, and the internal notes the determination rested on. You are entitled to see the basis for the decision, and a decision that turns out to rest on very little is a different conversation from one that rests on a lot.

Reasserting the error

Be clear-eyed about what this does. Under 12 CFR 1005.11(e), an institution that has fully complied with the error-resolution requirements has no further responsibilities under that section if you later reassert the same error. There is one exception in the rule: an error you assert after receiving information you requested under 12 CFR 1005.11(a)(1)(vii). That is another reason to request the documents first. New information can support a new notice of error in a way that simply repeating the original claim cannot. Reasserting is not pointless, but it is not a second automatic investigation either, and the routes in section 7 exist precisely because of that.

5. How much you can be held liable for

For an unauthorized electronic fund transfer, your liability is capped, and which cap applies depends on how fast you reported. The tiers in 12 CFR 1005.6(b) run from different events, which is exactly why summaries garble them.

Tier one — $50. If you notify the institution within two business days after learning of the loss or theft of the access device, your liability is the lesser of $50 or the amount of unauthorized transfers that occurred before you gave notice. The clock here runs from when you learned of the loss or theft, not from the transfer.

Tier two — $500. If you do not notify within those two business days, liability is the lesser of $500 or the sum of two things: $50 or the amount of unauthorized transfers occurring within the two business days, whichever is less; plus the amount occurring after the close of those two business days and before you gave notice — and only if the institution establishes that those later transfers would not have occurred had you notified it within the two-day period.

The category that is not capped. An unauthorized transfer that appears on a periodic statement must be reported within 60 days of the institution transmitting that statement. If you do not, your liability for transfers occurring after the close of those 60 days and before you gave notice is not subject to the $50 or $500 ceilings — the institution must establish that those transfers would not have occurred had you reported in time, but there is no dollar cap on that exposure. This is why the advice is “report it today” rather than “report it soon.” Note also that the first two tiers apply where an access device was involved; for unauthorized transfers made without one, the 60-day statement rule is the operative limit.

Two more things belong here. Delay caused by extenuating circumstances — an extended hospital stay, for instance — obliges the institution to extend these times to a reasonable period. And your own carelessness is not a factor: the CFPB has confirmed that an institution cannot consider consumer negligence when determining liability for an unauthorized transfer.

These federal figures are a floor, not a ceiling. Where state law or your account agreement imposes less liability than the regulation does, the lower amount governs. Read your account agreement, and check your own state’s rules. We publish no state-by-state list here because the accurate answer for you is in the two documents that actually bind your institution.

6. The hard part: deception is treated differently

Say this part plainly too: these schemes are designed and operated by people who do this professionally, at scale, with scripts refined against thousands of targets. Being deceived by one is not carelessness. The regulation draws a line based on who pressed send, and that line is about the mechanics of the transfer, not about your judgment.

The other side of the line is genuinely different, and it is worth understanding precisely because it is more favorable than most people assume. Where someone obtained your login details, card number or a one-time code — including by tricking you into handing them over — and then initiated the transfer themselves, the analysis changes. The CFPB’s own guidance is direct on this: a consumer who is fraudulently induced into providing account information has not “furnished an access device” within the meaning of the exclusion in 12 CFR 1005.2(m)(1), and transfers a third party then makes with that information are unauthorized electronic fund transfers under Regulation E. The commentary makes the same point for a device obtained by fraud or robbery, and treats an ATM transfer induced by force as unauthorized.

Whether a particular set of facts falls on one side or the other is fact-dependent, and nothing on this page classifies your situation. What we can tell you is which question decides it: not whether you were deceived, but who actually initiated the transfer.

What remains when the regulation does not require reimbursement

The regulation setting a floor does not mean nothing is left. Several routes stay open, and none of them requires you to be right about the legal characterization to be worth taking.

Your institution’s own policy, and the policy of the transfer network involved, may be more generous than the law requires. Ask what their scam-reimbursement policy is, in writing, and ask them to point you to it.

Put a written complaint to the institution through its formal complaint process, not the fraud phone line, and ask for a written response.

Complain to the federal consumer regulator through the CFPB’s complaint process. It forwards your complaint to the institution for a response and tracks whether one comes back.

Report the fraud itself to the FTC at ReportFraud.ftc.gov and to the FBI’s Internet Crime Complaint Center. Neither is a refund mechanism, and we will not pretend otherwise — but both feed investigations, and both create a dated official record of what happened, which is useful to have.

Your state attorney general’s consumer protection office takes complaints and, as the litigation below shows, sometimes acts on them.

And where the sum is within your state’s limit, small claims is a real route: see How to Sue in Small Claims Court.

One thing you should not do: do not contact the person who received the money. It exposes you to a second approach from people who already know you can be reached and already know you have funds.

The litigation position, stated once

Because a lead-generation industry is publishing pages that suggest otherwise, here is the factual position as of publication. A federal enforcement action brought against the operator of a major instant account-to-account transfer network and three large banks was filed in December 2024 and voluntarily dismissed with prejudice in March 2025. A separate state enforcement action against the network operator was filed in August 2025 and, on July 20, 2026, survived a motion to dismiss almost entirely; it is proceeding into discovery. A ruling on a motion to dismiss decides only that the allegations, assumed true, state a legal claim — it decides nothing about whether the defendant did what is alleged. There is no settlement fund, no claim form and no eligibility process attached to either action. Any page telling you that you may qualify for a payout is not describing something that exists. Bills have also been introduced in Congress to extend these protections to fraudulently induced transfers; none has been enacted.

7. When the bank says no

A denial is a stage, not the end of the process. Take the steps in this order, because each one produces something the next one uses.

Get the decision and its reasons in writing

You are entitled to this. The report of results must include a written explanation of the institution’s findings whenever it determines that no error occurred or that an error occurred differently from how you described it. If you were told no over the phone, ask for the written explanation and note the date you asked.

Request the documents they relied on

Do this next, and do it in writing. The same paragraph that requires the written explanation requires that explanation to note your right to request the documents the institution relied on, and requires the institution to provide copies promptly on request. Ask for the transaction and authentication records, any device or session data, and the internal records the determination rested on. This is the single most useful action available after a denial and almost nobody takes it.

Reassert the error — and know what that does

An institution that has fully complied with the error-resolution requirements has no further obligation under that section if you simply reassert the same error. The exception is an error asserted after you receive information you requested. So a reassertion built on documents you have now seen stands on different ground from one that just repeats the original claim.

Escalate in writing inside the institution

Use the formal complaint channel rather than the fraud line. Ask for a written response and a reference number. A documented internal escalation is also what a regulator’s complaint process will ask you about.

Complain to the federal consumer regulator

The CFPB’s complaint process forwards your complaint to the institution, gives it a window to respond, and records whether it does. It is a channel for getting a documented answer from the institution, not an adjudicator that orders refunds.

Report to the federal fraud and internet-crime channels

ReportFraud.ftc.gov and the FBI’s Internet Crime Complaint Center are worth using even though neither returns your money. They feed investigations and they create an official dated record. We publish no recovery statistics because honest ones do not exist at the level of an individual case.

Small claims, where the sum fits

If the amount is within your state’s small claims limit, that route is open and does not require a lawyer: How to Sue in Small Claims Court.

When independent advice is worth the cost

Consider it when the sum is large, when the facts are contested, or when the documents you receive do not match the explanation you were given. A consultation with a licensed attorney in your state is the right way to test that. We do not maintain a directory and we do not refer.

8. The call that says it is your bank’s fraud department

This section exists because the pattern is running hard right now and because it aims directly at the reader of this article.

The call sounds correct. The caller ID shows a familiar name. The caller knows the last four digits of your account. They say suspicious activity has been detected, that your money is not safe where it is, and that you need to move it to a “safe account” — or read back a code that has just arrived on your phone. The FCC’s own consumer alert on bank impersonation states the rule flatly: banks will never call or text and ask you to move your money to protect it.

Here is why this scheme targets you specifically, and it connects directly to section 6. Money that you move during that call is a transfer you initiated. That generally puts it outside the definition of an unauthorized electronic fund transfer, and outside the error-resolution duties described on this page. The scheme is built precisely to get you to press send yourself. That is the whole point of the script.

The rule to follow: hang up and call the number printed on the back of your own card or on your own statement. Not a number the caller gives you. Not a number from a search result. Not a number in a text message. The number you already have in your possession is the only one you can verify, and calling it costs you nothing if the call was real. This article publishes no telephone number for any institution, deliberately — a published number is exactly what this scheme exploits.

Two more things. If you gave a code or credentials during such a call and someone else then moved the money, that is the other side of the line — say so precisely when you report it, because who initiated the transfer is the question that decides the analysis. And if you moved the money yourself, report it immediately anyway: to your institution, to the fraud-reporting channels in section 6, and in writing.

9. Protecting the account afterwards

Keep this short and practical. Change the credentials for the account and for the email address that can reset them, and do not reuse either anywhere else. Treat one-time codes as unshareable in every circumstance without exception — no legitimate institution, agency or company ever needs one read back to them.

Turn on transaction alerts if your institution offers them, at a threshold low enough to be useful rather than ignorable. The value is not the alert itself; it is that it collapses the gap between a transfer happening and you knowing about it, and every liability tier in section 5 is measured in that gap.

Read your statements when they arrive, not when something feels wrong. The reporting clock runs from the day the statement is sent, so a statement you open three weeks late has already spent three weeks of your window.

10. Frequently asked questions

What is a provisional credit?

A temporary credit an institution puts in your account for the amount of the error you reported, so that it can take longer than the standard window to investigate. It looks like a refund on your statement and it is not one yet.

Is a provisional credit the same as being refunded?

No. It is a deadline extension the institution has paid for, not a finding in your favor. A refund is what happens if the investigation concludes that an error occurred; the correction is then made within one business day of that determination.

When is a bank required to give one?

Whenever it cannot complete its investigation within 10 business days of your notice and wants the longer period. Under 12 CFR 1005.11(c)(2), the extension to 45 days is available only if it provisionally credits your account within those 10 business days — 20 business days for a transfer within 30 days of the account’s first deposit.

How long does a bank have to investigate?

Ten business days from receiving your notice as standard. Up to 45 calendar days if it provisionally credits you first. Up to 90 calendar days for point-of-sale debit card transactions, transfers not initiated within a state, and transfers within 30 days after the account’s first deposit.

Can I spend a provisional credit?

Legally yes — the rule requires that you be given full use of the funds during the investigation. Practically, leave it alone if you can. If the investigation goes against you, the money comes back out of whatever balance is in the account that day.

Why was my provisional credit reversed?

Because the investigation concluded and the institution determined that no error occurred. The credit was conditional on the outcome. It must notify you of the date and the amount of the debiting, and its report must include a written explanation of the findings.

Can a bank take back money it already gave me?

Yes, where the money was a provisional credit and the institution determined no error occurred. It cannot do so silently, and it cannot do so without giving you the written explanation and telling you about your right to the underlying documents.

What happens if I already spent it and my account goes negative?

For five business days after the notification of the debiting, the institution must honor checks, drafts and similar instruments payable to third parties and preauthorized transfers, without charging you as a result of an overdraft — limited to items it would have paid had the credit not been debited. After that window, ordinary overdraft rules resume.

What if my bank won’t refund an unauthorized transaction?

Get the decision and its reasons in writing, then request the documents it relied on. Those two steps come first because everything else uses what they produce. After that: reassert the error if the documents support it, escalate internally in writing, complain to the federal consumer regulator, report to the federal fraud channels, and consider small claims if the sum fits. Section 7 sets out what each route can and cannot do.

Can I see the evidence the bank used to deny my claim?

Yes. The written explanation of the findings must note your right to request the documents the institution relied on in making its determination, and on request it must promptly provide copies.

What counts as an unauthorized transaction?

Under 12 CFR 1005.2(m), a transfer from your account initiated by someone other than you, without actual authority, from which you receive no benefit. It excludes transfers by a person you gave your access device to — unless you told the institution that person is no longer authorized — transfers made with your own fraudulent intent, and errors committed by the institution itself.

Do banks refund money lost to a scam?

Generally not under this regulation, where you initiated the transfer yourself. A transfer you were deceived into sending was still initiated by you, so it generally falls outside the definition of an unauthorized transfer. Where someone obtained your credentials or a code and moved the money themselves, the analysis is different and the protections generally apply. Some institutions and networks have policies more generous than the law; ask for theirs in writing.

How long do I have to report it?

Sixty days from the date the institution sends the statement on which the error first appears — not sixty days from the transaction. A notice after that period does not necessarily end the matter, but the institution’s obligations under this part of the rule change, and your liability exposure changes with them.

How much can I be held liable for?

Up to $50 if you notify within two business days of learning of the loss or theft of the access device; up to $500 if you notify after that, subject to the conditions in the rule. For unauthorized transfers appearing on a statement that you do not report within 60 days of the statement being sent, the exposure for transfers after that point is not capped at either figure.

Can a wire transfer be reversed?

Not through the process in this article. Wires through Fedwire and similar systems are excluded from Regulation E, and domestic wires are generally governed by UCC Article 4A as adopted by your state. Contact your institution immediately regardless — a recall request is possible in some circumstances and speed is the only variable you control.

What is the $3,000 bank rule?

There is no $3,000 rule governing refunds, disputes or investigations. See the correction below.

Does FDIC insurance cover fraud?

No. Deposit insurance protects your money against the failure of the insured institution, not against theft from your account. The two get conflated constantly. What it does cover is set out in FDIC Insurance Limits 2026: What’s Covered and What Isn’t.

Can the police get my money back?

Reporting is worthwhile and it is not a refund mechanism. Reports to the federal fraud and internet-crime channels feed investigations and create an official record, but law enforcement recovery is not a process with a timetable you can rely on, and anyone quoting you a recovery rate for your own case is guessing.

One related clarification, because the phrase sends people to the wrong place entirely. “Wire fraud” in the legal sense is a federal criminal offense — a category of prosecution brought by the government against a defendant. It is not a consumer remedy, and searching it will take you to material about charges, penalties and defenses that has nothing to offer someone whose own wire went to the wrong place. If your money left by wire, the framework you need is UCC Article 4A and your institution’s recall process, discussed in section 1.

This article is for educational and informational purposes only and is not legal or financial advice, and AdvoraHQ is not a bank, a law firm, or a fund-recovery service. The federal rules described here apply to consumer accounts and to particular categories of electronic transfer; other transfers, including domestic wire transfers, business accounts, and credit card transactions, are governed by different rules with different deadlines and different remedies. Deadlines, liability limits, exceptions and extended periods are stated as general principles verified against the Electronic Fund Transfer Act, Regulation E and the accompanying official interpretations as of publication, and they may change; your account agreement, your state’s law, and your institution’s own policy may give you more than the federal minimum and may impose their own procedures. Whether a particular transfer is unauthorized within the regulatory definition depends on facts specific to you, and nothing here classifies your situation or predicts what your institution, a regulator, or a court will decide. The tools on this page use only the dates and answers you enter, store nothing, send nothing anywhere, do not assess your claim, and do not determine whether any deadline was missed. Consult a licensed attorney in your state about your own circumstances.

Last updated: September 5, 2026