Debit Card Fraud: Dispute Steps, Liability Limits, and Refunds

To get your money back from debit card fraud, call your bank’s fraud line the moment you spot the unauthorized charge, then follow up with a written dispute. Under federal law, reporting within two business days caps your personal liability at $50. Wait longer and that ceiling climbs to $500, and past 60 days from the statement date, there is no ceiling at all.

Call the Bank and Freeze the Card First

Use the number on the back of the card or on your bank’s website. Tell the representative you have unauthorized transactions and need the card blocked immediately. Ask them to disable any linked digital wallet access as well.

While you are on the phone, write down the date and time, the representative’s name, and any reference or case number. Your liability under federal law hinges on when you notified the bank, so this record is the proof of your reporting date. Do not hang up until you have confirmed the card is frozen or canceled.

If the card was loaded into Apple Pay, Google Pay, or another mobile wallet, remove it from those platforms too and confirm with your card issuer that the token has been deactivated on their end.

Put Your Dispute in Writing

The phone call stops the bleeding. A written dispute locks in your legal protections. Regulation E requires you to send written notice of the unauthorized transactions, and the bank must receive it within 60 calendar days after it sends the statement that first showed the fraudulent charge.¹ Miss that window and you can lose the right to dispute those specific transactions.

Your letter should include your name and account number, the dates and amounts of the unauthorized transactions, and a clear statement that you did not authorize them. Attach copies of the relevant bank statements. Send everything by certified mail with return receipt so you have proof of the date the bank received it. That receipt becomes your most important document if the dispute drags on.

Also file a police report through your local non-emergency line and an Identity Theft Report at IdentityTheft.gov. The FTC report carries legal weight when you ask businesses to close fraudulent accounts or remove unauthorized charges, and it comes with a personalized recovery plan.² Include the police report number in your written dispute to the bank.

How Much You Can Be Held Liable For

The Electronic Fund Transfer Act and Regulation E set a tiered liability system based entirely on your reporting speed. The clock starts when you learn about the fraud, not when it happened.

Within 2 business days: Maximum liability is $50, or the total unauthorized transfers that occurred before you notified the bank, whichever is less.³
After 2 business days but within 60 days of the statement: Maximum liability jumps to $500, and only if the bank can show the additional losses would not have happened had you reported sooner.³
After 60 days from the statement: You are responsible for every unauthorized transfer that occurs past that 60-day mark, with no cap.³

The bank carries the burden of proof. If it wants to hold you liable beyond the minimum, it has to establish that the transfers would not have occurred if you had reported sooner. You do not have to prove you did not make the charge.

What the Bank Must Do Next

Once your bank receives notice, it has 10 business days to investigate and decide whether an error occurred. If it needs more time, it can extend the investigation to 45 calendar days, but only if it provisionally credits the disputed amount to your account within those first 10 business days.¹ That provisional credit gives you access to the money while the bank sorts things out.

The timelines stretch for point-of-sale debit card transactions, transfers that originated outside the United States, and accounts opened within the previous 30 days. In those cases, the bank gets 20 business days instead of 10 for provisional credit and up to 90 calendar days instead of 45 to finish the investigation.⁴ Most in-store debit card fraud is point-of-sale, so the longer clock applies more often than people expect.

If the bank confirms the fraud, the provisional credit becomes permanent. If it decides against you, it must send a written explanation and give you at least three business days’ notice before pulling the provisional credit back.¹

Ask for Zero-Liability Network Protection

The federal caps are the legal floor. Most debit cards carry stronger protection through the card network. Visa’s Zero Liability Policy covers debit and credit cards for unauthorized charges online or in person, and Visa requires issuing banks to replace stolen funds within five business days of notification.⁵ Mastercard offers a similar zero-liability guarantee for purchases in stores, online, over the phone, or through a mobile device, plus ATM transactions.⁶

Both networks require you to have used reasonable care with the card and to report promptly. Neither policy covers commercial cards or anonymous prepaid cards like gift cards. If your bank cites only the $50 or $500 EFTA limits when resolving your claim, push back and ask about the card network’s zero-liability policy. It often produces a better result.

If the Bank Denies Your Claim

A denial is not the end of the road. Start by requesting the written explanation the bank is required to provide. Read it closely to see whether the bank actually investigated or simply rubber-stamped a denial.

Then file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB forwards your complaint to the bank, which generally must respond within 15 days. That alone often produces results a customer service call cannot.

Federal law gives you real leverage if you need to escalate further. If a bank fails to provisionally credit your account within the required 10 business days and either did not investigate in good faith or had no reasonable basis for concluding you authorized the transaction, a court can award treble damages, three times the amount of your proven loss. Beyond that, the EFTA allows you to recover actual damages, statutory damages between $100 and $1,000, and attorney’s fees.⁷ Banks know these penalties exist, which is why a well-documented dispute rarely goes to court.

Payment Apps and Business Cards: Two Boundaries

If someone accessed your Venmo, Cash App, Zelle, or similar service and moved money from your linked debit card without permission, Regulation E still applies. Those peer-to-peer transfers count as electronic fund transfers, so the same liability tiers and timelines govern your claim.⁸ Report to both the payment app and the bank that issued your debit card. The bank has the legal obligation to investigate.

The harder case: if you voluntarily sent money to someone who turned out to be a scammer, that transfer may not qualify as unauthorized because you initiated it, even under false pretenses. File the claim anyway, but temper expectations.

Business debit cards mostly sit outside these protections. The EFTA defines “consumer” as a natural person, and Regulation E was built for individual consumer accounts.⁹ For a compromised business card, your recovery rights depend on the account agreement and any commercial card protections the network offers. Some banks voluntarily extend consumer-like protections to small business accounts; others offer almost none.

Stop Recurring Charges and Lock Down the Rest

Canceling a debit card does not automatically stop recurring charges. Visa and Mastercard run account-updater services that share your new card number with merchants who have your old card on file for subscriptions or recurring billing.¹⁰ A gym membership or streaming service can keep charging even after the compromised card is gone.

List every service that auto-bills your card and either update each one with your new details or cancel the ones you no longer want. To kill a recurring payment outright, federal rules let you send a stop-payment order to your bank at least three business days before the next scheduled transfer. You can do this by phone, but the bank may require written follow-up within 14 days for the stop-payment to remain in effect.¹¹

Debit card fraud sometimes signals a broader compromise. Place a fraud alert by contacting one of the three major credit bureaus, Equifax, Experian, or TransUnion, which is required to notify the other two. An initial alert lasts one year and entitles you to a free credit report from each bureau. A security freeze goes further, blocking access to your credit report entirely until you lift it; all three bureaus must place and remove freezes for free, and you contact each bureau separately.¹²

Choose a new PIN unrelated to birthdates or addresses. Change the passwords on your online banking and the email account linked to your bank, and turn on two-factor authentication. Then turn on real-time transaction alerts in your bank’s app for every debit card charge, not just those above a threshold. Since federal liability hinges on how fast you report, instant notifications can be the difference between a $0 loss and a $500 one.

1
eCFR. 12 CFR Part 205 Electronic Fund Transfers (Regulation E) – Section: 205.11 Procedures for Resolving Errors
2
Federal Trade Commission. Identity Theft Steps
3
eCFR. 12 CFR Part 205 Electronic Fund Transfers (Regulation E) – Section: 205.6 Liability of Consumer for Unauthorized Transfers
4
Consumer Financial Protection Bureau. 12 CFR 1005.11 Procedures for Resolving Errors
5
Visa. Visa Zero Liability Policy
6
Mastercard. Mastercard Zero Liability Protection Policy
7
Office of the Law Revision Counsel. 15 USC 1693m Civil Liability
8
eCFR. 12 CFR Part 205 Electronic Fund Transfers (Regulation E)
9
GovInfo. 15 USC 1693a Definitions
10
Visa. Visa Account Updater for Merchants
11
eCFR. 12 CFR 205.10 Preauthorized Transfers
12
Office of the Law Revision Counsel. 15 USC 1681c-1 Identity Theft Prevention Fraud Alerts and Active Duty Alerts