Federal rules require banks to reimburse customers for payments made without their authorization, such as by hackers, but not when customers themselves make the transfer.