Since January 1, 2026, California law has required banks and credit unions to delay certain transactions by three business days and to notify a trusted contact when they should reasonably suspect an older customer is being financially exploited. The law is Senate Bill 278, authored by Senator Bill Dodd of Napa, and it appears at Welfare and Institutions Code sections 15665 through 15669.9.
The duty applies only to a narrow class of transactions: five thousand dollars or more, where the customer dealt with a bank employee, in California. An online transfer, an ATM withdrawal, or a payment made through an app is outside the statute entirely.
Where the duty applies and the institution fails it, the customer may sue the institution for damages, and a plaintiff who prevails is entitled to attorney’s fees.
Before January 1, 2026, no California statute imposed this duty. That date is the first thing to check.
For most of the last thirty years, a California customer who was tricked into authorizing a transfer had almost no claim against the institution that executed it. The reasoning was consistent across the cases: the customer authorized the transaction, the bank followed the instruction, and a bank has no general duty to investigate what its customer is doing with his own money. Courts required actual knowledge of the fraud before a financial institution could be held to have assisted it.
That architecture still stands for most transactions. SB 278 did not tear it down. It cut a narrow, dated opening in it.
Inside that opening, the standard is no longer actual knowledge. It is whether the institution should reasonably suspect that the transaction results from financial abuse — an objective standard, measured against what a reasonable institution in that position would have suspected.
| Before Jan. 1, 2026 | On or after Jan. 1, 2026 (covered transactions only) | |
|---|---|---|
| Standard | Actual knowledge of the fraud | Should reasonably suspect financial abuse |
| Duty to pause | None | Mandatory three-business-day delay |
| Duty to notify | None | Mandatory notice to joint accountholder or trusted contact |
| Attorney’s fees | Not available on this theory | Mandatory for a prevailing plaintiff |
Section 15665(c) sets a three-part test. All three must be true.
A cash withdrawal counts toward the threshold.
The statute reaches transactions the older adult “requested, initiated, or completed” in dealings with one or more employees of the institution. A branch visit qualifies. A phone call to a banker qualifies. An online wire, an ATM withdrawal, a mobile-app transfer, or a peer-to-peer payment made without any employee contact does not.
The customer must also be a covered accountholder — an elder, meaning sixty-five or older, or a dependent adult where the institution had actual knowledge of that status.
The institution must be a covered person or entity — a mandated reporter of suspected financial elder abuse under section 15630.1, or that person’s employer. That reaches banks, credit unions, savings associations, and broker-dealers doing business in California, and it reaches them at the institutional level.
If the institution should reasonably suspect a covered transaction is the result of financial abuse, it shall delay the transaction by three business days. It may hold it longer, and it may refuse it outright.
The Legislature protected institutions that act. An institution that delays or refuses a transaction on suspicion of financial abuse is immune from liability for that delay — including, expressly, immunity under the funds-transfer provisions of the Commercial Code. A bank that pauses a legitimate transfer for three days is not exposed for having done so.
The institution shall notify a joint accountholder, or the emergency financial contact the customer designated, unless it reasonably believes that person is participating in the abuse. The notice may go out before or during the three-day hold. Good-faith notification is likewise immunized.
The two duties above presuppose machinery, and section 15666 requires it. Every covered institution must establish an emergency financial contact program, conduct outreach to all existing older accountholders asking them to designate a contact, solicit one at account opening for new customers, try again annually where no contact has been given, and keep records of those designations and confirm their accuracy each year.
Whether an institution actually built that program is often the most revealing question in a case that arises under this statute.
This is the part most summaries leave out, and leaving it out sets families up for a second disappointment.
Where an institution violated the notice or delay duty on more than one occasion as to the same customer, and the customer suffered financial abuse as a result, the institution is liable for actual and noneconomic damages. This route does not require proof of recklessness. It requires two or more violations and a causal link.
This matters because of how these scams are actually run. The perpetrators rarely take everything at once. They keep the victim on the telephone and send him back — a second transaction, often a second day, sometimes a second branch. Each covered transaction carries its own delay duty and its own notice duty. Two transactions can mean two violations.
A single violation suffices if the abuse resulted from the institution’s reckless disregard of these duties. The bar is high and the statute defines it by exclusion: inadvertence, incompetence, unskillfulness, and a failure to take precautions do not qualify. What does is closer to a conscious choice made with knowledge of the danger — no program at all, no training, an internal alert that fired and was cleared by someone who moved the money anyway.
Under either route, a prevailing plaintiff shall be entitled to reasonable attorney’s fees and costs. The word is mandatory.
Section 15665(b) defines the duty-holder as the mandated reporter or their employer. The obligation belongs to the institution.
That distinction decides cases. If a customer is sent to a second branch for a second transaction, the question is not whether the employees at the second counter knew what happened at the first. It is what the institution knew, and where inside its systems that knowledge was sitting when the second transaction executed. A monitoring alert that fired after the first transfer is the institution’s knowledge, wherever the second transfer was processed.
Ask them in this order. A “no” on the first three ends the inquiry.
Two further questions do not decide coverage but often decide value: whether the institution ever solicited an emergency financial contact from the customer, and whether the institution’s own monitoring systems flagged an earlier transaction before a later one was executed.
The exact date and time of every transaction, from the statements rather than from memory. The branch locations. Copies of any wire request or withdrawal forms. Any record or recollection of what employees said at each counter. Whether the bank ever asked the customer to name a trusted or emergency contact. And the customer’s account agreement, which governs matters the statute does not.
Bring all of it to the first meeting. Time limits in this area can be short, and they are not extended by the fact that you have been busy dealing with the loss.
Sometimes, and only in narrow circumstances. If the transfer was five thousand dollars or more, took place on or after January 1, 2026, occurred in California, and the customer was sixty-five or older and dealt with a bank employee, Welfare and Institutions Code sections 15665 through 15669.9 may apply. Outside those conditions, the older rule generally governs and the bank is usually not liable for executing a transfer its customer authorized.
Section 15668 requires a bank or credit union to delay a covered transaction by three business days when it should reasonably suspect the transaction results from financial abuse of an older or dependent adult. The institution may hold it longer or refuse it, and it is immune from liability for doing so.
A person at least eighteen years old whom an accountholder authorizes the institution to contact if it suspects the accountholder is being financially exploited. Section 15666 requires covered institutions to ask their older customers to designate one, to ask again annually if none is given, and to keep records of the designations.
No. The statute reaches only transactions in which the older adult interacted with one or more employees of the institution while requesting, initiating, or completing the transaction. A transfer made entirely online, through a mobile app, or at an ATM falls outside it.
No. The article became operative on January 1, 2026 and does not apply retroactively. A transaction before that date is governed entirely by prior law.
Yes. Section 15669.1(c) provides that a prevailing plaintiff is entitled to reasonable attorney’s fees and costs.
No. A trebling provision appeared in earlier drafts and was removed before the bill was enrolled. The statute provides for actual and noneconomic damages.
Generally no. The article bars personal liability for nonmanagerial employees and, more broadly, for California-based employees of covered institutions. The claim runs against the institution, which remains responsible for its own acts and for those of its employees.
Only where the institution had actual knowledge that the accountholder is a dependent adult. For an accountholder sixty-five or older, no knowledge on the institution’s part is required.
The institution is immune from liability for a delay or refusal made on suspicion of financial abuse. That immunity is one of the reasons the Legislature was able to impose the duty.
Michael Hackard is a California trust and estate litigation attorney with fifty years of experience representing families in elder financial abuse, inheritance disputes, and trustee misconduct cases. He is the author of six books on elder vulnerability and family protection, including Stolen Inheritance and Alzheimer’s, Widowed Stepmothers & Estate Crimes. He is AV Preeminent rated by Martindale-Hubbell for more than 40 years and has testified before the U.S. House of Representatives, Committee on Ways and Means.
Hackard Law handles trust, estate, and elder financial abuse matters throughout California on a contingency fee basis.
This page is general information about California law, not legal advice, and reading it does not create an attorney-client relationship. There is no published California appellate authority interpreting these sections as of September 2026.
Michael Hackard | Hackard Law | California State Bar #71067
Hackard Law represents families throughout California. | hackardlaw.com
(916) 313-3030