Disputing a Denied Refund for Unauthorized Payment App Transactions

Attorney Answer

Federal law limits how much you can be made to lose from unauthorized transactions, and a late report does not wipe out that protection for the transfers already shown on your statement.

The Electronic Fund Transfer Act, 15 U.S.C. § 1693g, caps a consumer's liability for unauthorized electronic transfers. The size of that cap turns on how fast the unauthorized activity was reported, including a 60-day window under 12 C.F.R. § 1005.6(b)(3) that runs from the day the statement showing those transfers was sent.

Separately, federal Regulation E, 12 C.F.R. § 1005.11, requires the financial institution to investigate a timely error report, generally determining the outcome within 10 business days, or taking up to 45 days if it provisionally credits your account in the meantime, and then to report the result to you.

Timing matters here, but not the way a blanket denial suggests. Your transactions date to late September into early October, and the 60-day clock is keyed to when the statement showing those transfers was sent — not to when the hack happened. Missing that deadline does not strip your protection from the transfers on that statement. Under 12 C.F.R. § 1005.6(b)(3), a late report forfeits protection only for unauthorized transfers that occur after the 60 days close and before you notify the institution, and only those the institution can establish would not have happened had you reported in time. Your liability for the transfers already shown on the statement stays capped — $50 under § 1005.6(b)(1), or as much as $500 under § 1005.6(b)(2) if you did not report a lost or stolen access device within two business days (both amounts as of publication). So a denial of the whole claim based on timing alone is not what the rule provides, which is why the first thing to do is find out what the denial was actually based on.

What you can do

1) Ask in writing for the specific reason your claim was denied, including whether the denial was based on timing.

2) Check whether the money moved through a linked debit card or bank account — those may carry separate dispute rights and deadlines that differ from the app's own policy.

3) File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov, which creates a formal record and sometimes prompts a second review.

4) Pull together the account statements covering the transactions, plus the denial email, so the relevant dates are all in one place.

5) Write out a dated timeline: when the transfers posted, when you first noticed them, when and how you first reported them, and when the denial came.

Time limits: Federal law ties your liability protection to specific dates tied to your account statement, not simply to when the fraud occurred, and extenuating circumstances can extend those periods. A Utah consumer-protection attorney can review your account records now to see whether any protection window remains open.