TL;DR: Report unauthorized payments at once. Under US Reg E, liability is capped at $50 if you report within 2 business days and can reach $500 after, and you must report within 60 days of a statement. Each app has its own steps.

👉 Check my digital footprint — free 30-second check →

Money apps move fast, so the first hour decides how much you can recover. This guide sets out what each provider publishes, plus the US federal timelines that can affect who bears the loss.

The US deadlines that matter

The CFPB's Regulation E rules cap your liability at $50, or the amount transferred before you gave notice if that is less, when you notify the institution within 2 business days of learning of an unauthorized transfer. After 2 business days it can reach $500. A consumer must report an unauthorized transfer that appears on a statement within 60 days, and liability can be unlimited for transfers after that window. Extenuating circumstances such as extended travel or hospitalisation can extend the deadlines. The CFPB says unauthorized transfers include those made with credentials obtained by hacking, phishing or social engineering, that consumer negligence such as writing down a PIN cannot increase liability, and that an institution cannot require a police report before investigating. The FTC's guidance on debit and ATM cards uses the same tiers. Whether Reg E covers a specific app depends on the account and the provider.

PayPal

PayPal says to call immediately through its contact page, and to report unauthorized payments in the Resolution Center: Report a problem, choose the payment, then "I want to report unauthorized activity". You receive an email within 10 days of reporting. PayPal may temporarily freeze your account during the investigation. Before you report, check whether a charge comes from a family member or an automatic payment such as a subscription.

Venmo

In the app go to Me, Settings, Get Help, then Chat With Us. Have the date and amount of the transaction and the username of the person you paid ready. Venmo says to report as soon as possible and points to the resolution procedures in its User Agreement. Phone support is available if you cannot get into the app.

Cash App

Select the transaction in the activity feed and tap Report, or call 1 (800) 969-1940. Cash App says you must notify it immediately and no later than 60 days after a suspicious charge appears to keep protection eligibility. Its named safeguards are Security Lock, Card Lock and real-time alerts for sign-ins and setting changes.

Chime

Contact Chime through in-app chat or by phone on (844) 244-6363, available 24/7. Chime's steps are to freeze your card, turn on alerts, use a strong unique password and enable two-factor authentication. It says it will never call or text you without your authorization, and that a compromised account cannot be reopened.

Coinbase

Lock the account: in the app go to Account & settings, Security, Lock Account. Locking signs you out of all devices and disables trading, sending, receiving and changes. To unlock, sign in and complete 2-step verification. Coinbase says crypto sends are paused for 24 hours after unlocking. It lists 24/7 phone support at +1 (888) 908-7930 in the US and Canada.

Robinhood

Contact support immediately if you still have access, or email support@robinhood.com if you are locked out. You can request a freeze, which blocks deposits, withdrawals and new positions while allowing you to sell existing assets. Robinhood says the investigation typically spans several weeks, with follow-up within 4 business days. Its Security Guarantee reimburses losses from unauthorized activity but not when your own actions enabled it. It advises contacting Robinhood only from inside your account rather than calling numbers from a search.

After the report

Change your email password, then read how to recover a hacked bank account and how to cancel a compromised card. Consider a US credit freeze.

Hackers often get in with a password that already leaked in an old breach. A free digital footprint check shows whether your email or number appears in exposed data.

Frequently Asked Questions

How fast must I report an unauthorized transfer in the US?

Under CFPB Regulation E, reporting within 2 business days caps liability at $50. After that it can reach $500, and you must report within 60 days of the statement.

Can an institution demand a police report first?

The CFPB says an institution cannot require a police report before investigating.

What is Cash App's reporting window?

Cash App says to notify it immediately and no later than 60 days after a suspicious charge appears.

How long does Coinbase pause sends after I unlock?

Coinbase says crypto sends are paused for 24 hours after unlocking.

Does Robinhood reimburse hacked accounts?

Its Security Guarantee reimburses unauthorized activity but not when your own actions enabled it.

Where do I report a PayPal unauthorized payment?

In the Resolution Center: Report a problem, choose the payment, then 'I want to report unauthorized activity'.

Sources

Related Reading