Chase denied my fraud claim - what are my options?

Reading this thread two years later because I'm going through almost the same thing with Chase right now. $2,100 in charges at gas stations three counties over. Same exact line from the rep: chip was used so it must be authorized.

Did the CFPB route end up working for you matt? Trying to figure out if I should bother with the certified letter or just go straight to the complaint.

One thing nobody mentioned: debit vs credit matters a lot here. Reg E (debit) gives you the protections people are describing. If this had been a credit card it would be the Fair Credit Billing Act and Reg Z instead, and your liability cap is generally $50 regardless.

Not legal advice, just something I learned the hard way. The bank reps blur the two and it confuses everyone.

Following. My credit union (not Chase) did the same chip excuse on a $780 dispute. The chip-can't-be-cloned argument drives me nuts because it's just not how the law works.

Whether the card was physically present is not the same question as whether the account holder authorized it. That distinction is the whole ballgame.

Clarifying question for the group: does the 60-day window run from the statement date or the transaction date? My charges were spread across two statement cycles and I'm worried I'm going to get told I waited too long on the older ones.

Trying to get my dispute letter exactly right before I send it.

Save every reference number. CFPB complaint number, the bank's internal claim number, the date and name of every rep you talk to. When I escalated, having a timeline with names made the second-level reviewer take me seriously fast.

Also request their investigation file in writing. Under Reg E you can generally ask for the documents they relied on to deny you. A lot of people skip that and it's one of the strongest moves.

Seconding the request-for-documents tip. When I asked Chase for their investigation file they sent me basically one page that said 'transaction completed with chip.' That's it. No evidence I authorized anything.

I forwarded that one-page nothing to the CFPB and said this is the entire basis for their denial. Credit reversed within two weeks.

Question, did any of you also notify your state's attorney general or DFPI if you're in California? Wondering if that adds pressure or just creates noise.

Tom, I added the CA DFPI complaint after the CFPB one and honestly I think it helped. Two regulators asking the same bank the same question is harder to ignore. It varies though, your mileage may differ depending on the institution.

I'd start with CFPB since that's the one banks clearly track, and add the state regulator if they stall.

Has anyone had the bank actually re-deny after a CFPB complaint? Mine came back a second time saying their decision stands. Not sure what's left after that besides small claims.

Different angle: check if the merchant name on the fraud charges is something you can look up. On mine, the 'electronics store' was a shell merchant that other people had reported online. I included links to those reports in my CFPB complaint and it corroborated that this was a known fraud pattern, not me.

How long did everyone wait before escalating? Chase told me 10 business days for the investigation and I don't want to jump the gun and look impatient, but I also don't want to sit around if they're just going to deny me anyway.

Patty, the original poster here from way back. The 10 business day figure usually ties to the provisional credit timing people mentioned. Generally if they don't finish the investigation within that window they're supposed to provisionally credit you while they keep looking.

I'd hold off on the CFPB complaint until they actually deny you, because the complaint is strongest when you can point to a final denial. But the second you get that denial, file same day.

One detail that tripped me up: Chase mailed the denial to my old address and I didn't see it for two weeks, which ate into my response time. Make sure your address on file is current and check your secure messages in the app, not just postal mail.

This thread is gold. Just want to add for anyone anxious about the money in the meantime: ask specifically for provisional credit in your dispute letter, by name. I didn't realize it was a thing until I read this and when I asked for it directly, they applied it within a few days while they investigated.

Counterpoint, not to be a downer: I did everything right, CFPB complaint, letters, the works, and Chase still held firm because their logs showed the PIN was entered correctly on a chip-and-PIN transaction. That made it much harder to argue the card wasn't in someone's hands who knew the PIN.

If your fraud involved your PIN being used, be ready for that to be the bank's main argument. Doesn't mean you lose, but it's a tougher fact pattern. Worth being honest with yourself about how the PIN could have leaked.

Dwight raises a real point. For mine there was no PIN, the charges were chip-and-signature, which made it easier. If yours involved a PIN, think hard about whether you ever wrote it down, used it at a sketchy ATM, or had your phone/wallet briefly out of sight.

Shimmers can capture chip data but the PIN piece is usually a separate compromise, like a camera or an overlay keypad.

On the police report question that keeps coming up: it won't make the cops investigate a $2k card fraud, realistically. But it does two things. It creates an official dated record that you reported this as a crime, and it signals to the bank and CFPB that you're serious and consistent. Inconsistency is what banks use to deny you.

So yes, file it, but set expectations. It's evidence for your dispute, not a criminal investigation that's going to catch the thief.

For anyone whose bank is dragging, I found that emailing the executive/CEO office (a quick search finds the format) got a callback from an actual specialized team in two days. They have a different escalation queue than the regular dispute line. Worked when the normal channel ghosted me for three weeks.

New here. My situation is slightly different, the fraud was on a business debit card, not personal. Does Reg E even apply to business accounts? Getting conflicting answers and the amount is $6,800 so I'm sweating.

Sam, that's an important distinction. Reg E's consumer protections are generally aimed at accounts established primarily for personal, family, or household purposes. Business accounts often fall outside those specific consumer protections, and your rights may instead be governed by your account agreement and other law, such as UCC Article 4A for certain transfers.

Because the framework is different and $6,800 is significant, I'd genuinely recommend having an attorney in your state review your account agreement rather than relying on the consumer-card playbook in this thread. This is general information only.

Lurker, finally posting. Question for the small-claims folks: did you sue the bank entity by its correct legal name, and where did you serve them? I tried once and it got tossed because I named the wrong entity and served a branch instead of the registered agent.

Feels like a small thing but it cost me months.

Marcus, yes, that detail matters a lot. Look up the bank's exact legal entity name and its registered agent for service in your state's business entity search before you file. Serving a branch usually doesn't count.

Not legal advice, but getting the defendant name and service right is what separates a case that sticks from one that gets bounced on a technicality. Your local small claims clerk can often point you to the right resources too.

This whole thread talked me off a ledge. Got my denial Monday, filed CFPB Tuesday, sent the certified letter asking for their investigation file Wednesday. Now I wait. Will update with whatever happens so the next person has more data points.

Bookmarking this for my brother who just got hit. The single most useful reframe in here for me was that 'card present' and 'I authorized it' are two different legal questions. Once you stop arguing about whether the chip can be cloned and start insisting the bank prove you consented, the whole conversation changes.

Thanks to the contributors and attorneys who keep repeating the hedges too, it keeps the rest of us from over-promising ourselves a result.

Adding my situation because it's a little different from OP's card fraud. I got hit with the "your account is compromised, move your money to a safe account" phone scam and sent $3,400 by Zelle before my brain caught up. Chase denied the claim: "you authorized the transaction." Which, technically, I did, while being lied to.

Is authorized-but-scammed just a lost cause with banks or is there an angle?

It's a real distinction, unfortunately. Unauthorized means someone else moved your money, and that's where the strong dispute rights live. When you push the button yourself, even under a con, banks treat it differently and the first answer is usually a denial like yours.

That said "first answer" is doing a lot of work in that sentence. Appeals and regulator complaints exist precisely because the first answer isn't always the final one. Some banks have been reimbursing certain imposter-scam cases under newer policies, it's inconsistent but not zero.

General information, not legal advice. The authorized/unauthorized line described above is the right frame, and it's why wording matters when you talk to the bank. If any part of the flow WAS outside your control, credentials phished, a device compromised, the payee changed after you confirmed, say so specifically, because those facts can move a case toward the stronger dispute category. If it was fully induced authorization, the productive path is a written appeal: ask for the denial reason in writing, ask what records they relied on, lay out the deception timeline, and file the regulator complaint so the response comes from a level above the call center.

Keep everything in writing and keep the dates straight. These outcomes are inconsistent bank to bank right now, but a documented, factual appeal costs you an evening and is the version of the fight that occasionally gets paid.

Update already: filed the CFPB complaint last night with the timeline and the police report number. This morning there's a voicemail from a Chase "executive escalations" line asking me to call back about my claim. No idea how it lands, but that's more motion in 12 hours than in the previous three weeks. Will keep this thread posted.

Coming back with the thing I wish I had known on day one of my denial.

When the bank determines no error occurred, Regulation E at 12 C.F.R. § 1005.11(d)(1) requires a written explanation of its findings, and it has to tell you that you can request the documents it relied on. On request the institution has to promptly provide copies.

Almost nobody asks. I asked, and the documents I got back were noticeably thinner than the denial letter implied. That is the leverage.

The timing rules in the same section are worth knowing because they tell you when to expect something rather than guessing.

Under § 1005.11(c)(1) the institution generally has 10 business days from your notice of error to investigate and determine whether an error occurred, and it reports results within 3 business days after completing. Under (c)(2), if it cannot finish inside 10 business days it can take up to 45 days total, but only if it provisionally credits your account within those 10 business days.

So a long investigation with no provisional credit is a thing you can ask about specifically, by date.

Adding the exception, because it catches people out and it applied to me.

§ 1005.11(c)(3) extends those numbers for certain transfers, including point of sale debit card transactions and transfers within 30 days of account opening. There the 10 business days becomes 20 business days and the 45 days becomes 90 days.

My claim was a card transaction and I spent a week convinced they had blown a deadline they had not blown. Check which bucket yours is in before you accuse anyone of anything.

One more distinction this thread keeps running into.

An unauthorised transfer and a transaction you authorised but regret are treated very differently. Payments you were tricked into sending yourself are the hardest category, because the error resolution machinery is built around transfers you did not authorise. That does not mean nothing can be done, but it does mean quoting the error resolution deadlines at the bank will not land the same way.

Be honest with yourself about which one yours is. It determines the whole approach.