Imagine logging into your business checking account and finding a chunk of your operating cash gone — withdrawn by someone you've never heard of. You call your bank. Instead of getting your money back, you get locked out of the account entirely while an "investigation" drags on. No timeline. No explanation. Your payroll is due Friday.
That's the scenario at the center of a new class action lawsuit against Intuit and its subsidiary Credit Karma, and it's a useful excuse to ask a question most small business owners never think about until it's too late: if your bank account gets drained by fraud, who actually has to make you whole — and does the law even require anyone to?
The answer depends on something most people never check: whether the account you're using is legally a "consumer" account or a "business" account. For freelancers, sole proprietors, and small business owners who bank at a neobank or fintech app, that distinction can be the difference between getting your money back in ten business days and never seeing it again.
What Falco v. Intuit Actually Alleges
On June 28, 2026, plaintiffs filed Falco et al. v. Intuit Inc. et al. (Case No. 5:26-cv-06451) in the U.S. District Court for the Northern District of California. The 52-page complaint alleges that Intuit and Credit Karma failed to maintain reasonable security protections for Credit Karma Money checking (Spend) and savings (Save) accounts, despite marketing them as a secure place to keep your cash.
According to the filing, thousands of accountholders experienced one or both of two things:
- Unauthorized withdrawals — money moved out of their accounts without their knowledge or consent
- Denial of timely access to their own money — accounts frozen or locked, sometimes for extended periods, while fraud reviews played out
The complaint points to specific alleged failures: weak authentication and transaction-monitoring systems, insufficient fraud-prevention controls, customer support channels that couldn't resolve issues quickly, and account lockouts that hit legitimate users just as hard as the fraudsters — sometimes harder, since the fraudster already has the money and the real accountholder is the one left waiting. The suit alleges these vulnerabilities date back to 2020.
The legal theory centers on the federal Electronic Fund Transfer Act (EFTA), which the plaintiffs say Intuit and Credit Karma violated by failing to conduct reasonable investigations or recredit affected accounts within the timeframes the law requires. The case is early — filed less than a month before this writing, with no class certified and no settlement fund yet — but the underlying issue it raises isn't specific to Credit Karma. It applies to every neobank, fintech banking app, and "banking-as-a-service" product that's proliferated over the last several years.
What Regulation E Actually Promises You
The EFTA and its implementing rule, Regulation E, are the reason a $50 unauthorized debit card charge doesn't ruin your month. If you report unauthorized activity within two business days of discovering it, your liability is capped at $50. Report between two and 60 days, and it's capped at $500. After 60 days, you can be on the hook for everything that happened after that window closed.
Once you report an error, the bank has real obligations on the clock:
- 10 business days to investigate and either resolve the issue or provisionally recredit your account for the disputed amount while the investigation continues
- Up to 45 days total to complete the investigation (20 days for accounts open less than 30 days), provided the provisional credit was issued
- A written explanation if the bank determines no error occurred, plus your right to request the documents it relied on
These aren't best practices — they're legal requirements with real teeth. A bank that blows through them without provisionally crediting your account is exposed to statutory damages, actual damages, and attorney's fees under the EFTA. This is the exact framework the Falco plaintiffs say Intuit and Credit Karma failed to honor.
The Catch: None of This Applies to Business Accounts
Here's the part that should make every small business owner pay attention. Regulation E only covers accounts established primarily for personal, family, or household purposes. A checking account opened for your LLC, your freelance consultancy, or your side business is, in the eyes of federal law, a commercial account — and commercial accounts are explicitly carved out of EFTA protection.
That means if fraud hits a business checking account, there is no federal ten-day clock, no provisional-credit requirement, no $50 liability cap. Whatever your bank's terms of service say about fraud liability is essentially the whole deal. Some banks and fintechs extend Reg E-style protections to business customers voluntarily, as a matter of policy or competitive positioning — but "voluntarily" is the operative word. Nothing forces them to, and nothing stops them from changing that policy tomorrow.
This creates a genuinely awkward gap for the exact people most likely to bank at a neobank in the first place: freelancers and solo founders who open a "personal" account like Credit Karma Money or a similar cash-management product and use it to run their side hustle or early-stage business, because a dedicated business account felt like overkill. If that blended account gets hit with fraud, whether Reg E applies can turn on how the account was actually used — not just what it's labeled — and that's a fight you don't want to be having with a bank's legal team while your rent is due.
Neobanks add a second wrinkle on top of the legal one: many operate as a thin app layer in front of an FDIC-insured partner bank that actually holds the money and does the underlying fraud monitoring. When something goes wrong, business owners often first find out through a vague in-app alert rather than a phone call from a human who can explain what happened or when it'll be fixed — a structural gap that shows up across the neobank industry, not just at one company.
How to Protect Your Business From This Exact Scenario
None of this means avoid neobanks — many offer genuinely better tools, lower fees, and faster onboarding than traditional business banking. It means bank at one with your eyes open.
Keep business and personal money in genuinely separate accounts. Beyond the tax and liability reasons you've probably already heard, a dedicated business account makes it unambiguous which protections apply and gives you one clean transaction stream to monitor — instead of hunting for a fraudulent $340 charge buried in your personal grocery and gas spending.
Ask before you open the account, not after something goes wrong. Find out in writing whether your bank or fintech extends any fraud-liability protection to business accounts, what its investigation timeline actually looks like, and whether the underlying deposits are FDIC-insured through a named partner bank. If support can't answer clearly, that's information too.
Reconcile weekly, not monthly. The EFTA's protections for consumer accounts hinge on reporting fraud within 2 and 60 days — miss the window and your liability balloons even where the law does apply. For a business account with no such statutory backstop at all, catching an unauthorized transaction fast is often the only recovery mechanism you have. A stale bank feed you glance at once a month is exactly how a small, repeated fraud pattern turns into a large one before anyone notices.
Keep records outside the bank's own app. If an account gets frozen mid-dispute, the only way to prove what you actually did — what invoices you sent, what vendors you paid, what your real cash position was — is a ledger you control independently of the platform that just locked you out.
That last point is where good bookkeeping habits stop being a compliance chore and start being a real safety net. Accurate, timely financial records don't just make tax season easier — they're what lets you catch a fraudulent withdrawal the same week it happens, not the same quarter, and prove your case if a bank's investigation doesn't go your way.
Keep Your Own Financial Record, Independent of Any One Bank
If Falco v. Intuit proves anything before it's even litigated, it's that you can't fully outsource trust in your money to an app's dashboard. Beancount.io gives you a plain-text accounting system that's transparent, version-controlled, and entirely yours — so your transaction history lives with you, not just inside a bank you're hoping never locks you out. Get started for free and keep a financial record that stays under your control no matter what your bank does.