That is not true. The law obligates the bank to make you whole (subject to certain limits if you delay reporting until well after you knew of the theft).
Three days from when you become aware does not seem unreasonable to me. Further losses are preventable and if you choose not to prevent them, it makes sense to me that you should bear some responsibility.
I'm not sure what you mean when you say you have to spend money to be made whole. I'm not aware of the banks having any right to charge you in order to get them to comply with the law. Would you please explain?
You would need to sue them in a court of law if they don't comply, which involves hiring a lawyer, which of course is needlessly expensive.
A bank that follows the law after your money has gone poof is the /best/ situation you can hope for, and probably isn't the /average/ or /median/ situation.
I don't check my many bank accounts every day and I prefer to spend days out in the wild with little internet. I will not be a happy camper on the day I'm hacked and my bank tries to explain why it's my fault that they can't pay me :)
I know several people who have had their bank accounts stolen at one point or another, and it's never required a lawsuit to be made whole. This is because almost all the transactions by which you can lose money through your bank are reversible, except for cash withdrawals.
