Debit card fraud protection comes from federal law, and how much you can recover after someone uses your card without permission depends almost entirely on how fast you report it. Under the Electronic Fund Transfer Act and its implementing rule, Regulation E, your liability can be as low as zero or, if you wait too long, unlimited. The same rules also force your bank to investigate on a fixed timeline and, in most cases, put the disputed money back in your account while it looks into the claim.1eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
How Much You Can Lose Depends on When You Report
Federal law sets three tiers of liability based on timing. When your physical card or PIN is lost or stolen, the clock starts the moment you learn about it — not when the fraudulent charge posts.2Consumer Financial Protection Bureau. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
- Report within 2 business days of learning of the loss or theft, and your liability is capped at $50 (or the total unauthorized amount, if less).
- Report after those 2 business days but within 60 days of the statement being sent, and your cap rises to $500 for the charges that happened during the delay.
- Report more than 60 days after the statement was sent, and you lose federal protection for any unauthorized transfers that happen after that 60-day mark. Losses from that point forward can be unlimited.3GovInfo. 15 USC 1693g – Consumer Liability
A more forgiving rule applies when only your card number is stolen — through a data breach, online skimming, or similar digital theft — and your physical card never leaves your possession. In that case, you have no liability at all, as long as you report the unauthorized charges within 60 days of the statement showing them. Miss that window, and you become responsible for further unauthorized transfers going forward.2Consumer Financial Protection Bureau. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
If you could not report on time because of extended travel, hospitalization, or another extenuating circumstance, the law requires the bank to extend both the 2-day and 60-day deadlines to a reasonable period.3GovInfo. 15 USC 1693g – Consumer Liability
What Counts as an Unauthorized Charge
Regulation E defines an unauthorized electronic fund transfer as one initiated by someone other than you, without your permission, from which you received no benefit. That covers a thief using a stolen card in a store, a hacker making online purchases with your card number, and forced ATM withdrawals.4Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
The CFPB has also said that if a scammer tricks you into sharing your login credentials or a confirmation code and then moves money out of your account, that still counts as unauthorized. Being deceived into handing over account information is not the same as voluntarily giving someone access.
Two situations do fall outside the definition. If you gave a family member, roommate, or anyone else access to your card or account, their transactions are not unauthorized unless you already told the bank to cut off that person’s access. And transfers you made yourself with fraudulent intent are never protected.
How to Report the Fraud
Contact your bank as soon as you spot the charge. You can call, use the mobile app, go in person, or mail a written dispute to the address on your statement. Notice is effective as long as you give the bank enough information to identify your account, even if you cannot immediately supply the full card number.2Consumer Financial Protection Bureau. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
Include your name and account number, the transactions you are disputing, the date and dollar amount of each, and why you believe the charge is wrong. If your card was lost or stolen, note the date you discovered it missing.
One detail catches many people off guard. If you report by phone, the bank can require written confirmation within 10 business days. If it does and you do not send it in time, the bank is no longer required to provisionally credit your account during an extended investigation.5Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution For a large claim, certified mail creates proof the written follow-up arrived on time.
What the Bank Has to Do After You Report
Once you report, the bank has 10 business days to investigate and tell you what it found. If it confirms fraud, it must correct the problem within one business day of that finding.5Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
If the bank needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account within the original 10-business-day window. The bank may hold back up to $50 from that provisional credit if it has a reasonable basis to believe fraud occurred. Three types of transactions get 90 days instead of 45: point-of-sale debit card transactions, foreign transactions not initiated within a state, and transfers on new accounts that happened within 30 days of the first deposit.6eCFR. 12 CFR 205.11 – Procedures for Resolving Errors
When the investigation ends, the bank has three business days to notify you of the outcome. If fraud is confirmed, the provisional credit becomes permanent. If the bank denies the claim, it must send you a written explanation, remove the provisional credit, and tell you that you can request copies of the documents it relied on.7eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
Debit Card Protection Is Weaker Than Credit Card Protection
Credit cards fall under a different federal law, the Truth in Lending Act. There, your liability for unauthorized charges is capped at $50 no matter when you report, with no escalating tiers based on speed. Most major issuers voluntarily waive even that $50.8GovInfo. 15 USC 1643 – Liability of Holder of Credit Card
The bigger practical difference is where the money sits. A fraudulent credit card charge is against your credit line — money you have not actually spent. A fraudulent debit card charge comes straight out of your checking account. Even with a provisional credit, you could wait up to 10 business days for temporary access to those funds, and in the meantime you may face bounced checks, missed automatic payments, and overdraft fees.
Zero Liability From Visa and Mastercard
The two largest card networks add their own protections on top of federal law. Visa’s Zero Liability Policy says you will not be held responsible for unauthorized charges on a Visa debit or credit card, whether the fraud happens online or offline. The policy excludes commercial cards, anonymous prepaid cards such as gift cards, and transactions not processed over the Visa network.9Visa. Zero Liability Policy
Mastercard’s Zero Liability Protection covers unauthorized debit card transactions as long as you used reasonable care in protecting your card and promptly reported the loss or theft. Mastercard also excludes commercial cards and unregistered prepaid cards.10Mastercard. Zero Liability Protection Policy
These are voluntary network policies, not federal law. Some transactions, particularly PIN-based ones processed outside the card network, may not qualify. If the network denies a zero liability claim, Regulation E remains your fallback.
If Your Claim Is Denied
Start by asking for the documents the bank used to reach its decision. You have a legal right to see them. Review the records for anything the bank missed or got wrong.
If you still think the denial was wrong, file a complaint with the Consumer Financial Protection Bureau online or by phone at (855) 411-2372. The CFPB forwards the complaint to the bank, which generally responds within 15 days. Include the key dates, amounts, and copies of your communications with the bank.11Consumer Financial Protection Bureau. Submit a Complaint About a Financial Product or Service A complaint does not guarantee a reversal, but it applies regulatory pressure and creates a formal record.
The Electronic Fund Transfer Act also lets you sue. A bank that violates the law is liable for your actual damages plus statutory damages between $100 and $1,000, and a winning consumer can recover attorney fees and court costs. You have one year from the violation to file. For smaller amounts, small claims court is usually the cheaper route, with filing fees that vary by jurisdiction but generally run from about $15 to $300.12Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability