The person moving money out of your checking account does not have to be a stranger with a stolen card. This month the OCC barred a branch banker at a Houston branch of PNC for, in the regulator’s own words, “making unauthorized debits from multiple customer accounts.”
Not a hacker. Not a skimmer on a gas pump. A guy at the desk inside the branch.
The OCC published the action on September 17, alongside a second one against a home-based phone banker in Corona, California, working for U.S. Bank, who embezzled about $329,088. Both got an Order of Prohibition, which is the regulator’s permanent door: no participation in the affairs of a bank, anywhere, again.
Now read the Houston line one more time, because there’s a word in it doing quiet work. “The bank suffered a loss of at least $74,550.”
The bank. Not the customers.
Why the bank ate it
The OCC doesn’t explain that part. Regulation E does.
When money moves out of your checking or savings account without your say-so, federal law decides who’s holding the bag, and the default answer is the bank. There’s a catch, and it’s a date.
The rule is 12 CFR 1005.6(b)(3). You have to report an unauthorized electronic transfer that shows up on a periodic statement “within 60 days of the financial institution’s transmittal of the statement.” Miss that, and you can be stuck with the unauthorized transfers that happen after those 60 days run out, if the bank can show they wouldn’t have happened had you spoken up in time.
Transmittal. The clock starts when the bank sends the statement. Not when you open the envelope, not when you finally tap into the app in January.
If a debit card was in the mix, two more tiers stack on: report within two business days of learning it’s gone and you cap at $50, miss that and it can run to $500.
Here’s the uncomfortable version. An insider doesn’t need your card or your password. They already have the system. The only tripwire left is you reading the statement, and the law gives you about two months to do it.
Do this today
Pull up the most recent statement on every deposit account you have and read it line by line. Not the balance. The lines.
Look for small debits you don’t recognize before you look for big ones. Someone taking money from inside a bank is trying not to trip a fraud model, which means amounts that look boring.
Found one? Call now, because the phone call is what stops the clock. The rule counts notice when you take the steps reasonably necessary to give the bank the information, in person, by phone, or in writing. Then follow it in writing so you own the date instead of arguing about it later.
And if you were in the hospital or overseas when the statement went out, say so. Regulation E requires the bank to extend the deadline to a reasonable period for extenuating circumstances. It is written into the rule. Use it.
One more thing worth knowing while you’re in there: an unauthorized transfer is not the same as a payment you were talked into sending. That distinction is the whole ballgame on peer-to-peer apps, and we broke it down in what decides whether a Zelle scam gets refunded.
Reading a statement is dull, and dull is the point. If you’re going to be in there anyway, compare what your cash is earning against our savings picks, run the gap through the savings calculator, and see the rest at our savings hub.
How Candid Yak makes money. Some of the products we write about pay us if you apply or sign up through our links. That never changes our verdict, our rankings, or the numbers in this article. We call a bad deal a bad deal whether it pays us or not. Some brands shown in our comparison tools are placeholder examples while we finalize partner agreements, and we label them as such.