Regulation E
The US rulebook for electronic transfers, and the thing that decides how much a consumer loses when someone else drains their account.
Regulation E implements the Electronic Fund Transfer Act of 1978, written when ATMs and direct deposit were still novelties. The Federal Reserve wrote the original rules; since Dodd-Frank moved the job in 2011 they belong to the CFPB. They cover debit cards, ACH, ATMs and most payment apps. The core is a liability cap: report an unauthorized transaction within two business days and the most you lose is $50, after that up to $500, and once 60 days have passed since the statement there is no cap at all.
The bank gets ten business days to investigate a claim, or 45 if it provisionally credits the money in the meantime. The live fight today is over what counts as unauthorized. Someone tricked into sending money over Zelle technically approved the transfer themselves, and that is where the protection stops.