If you spot an unauthorized transaction on your debit card, call your bank’s fraud department right now, cancel the card, and open a dispute. Under the federal Electronic Fund Transfer Act, how much you can be forced to eat depends almost entirely on how quickly you report the charge: $50, $500, or potentially everything drained after a 60-day window closes. The first 48 hours matter more than anything else you’ll do.
Call the Bank and Cancel the Card
Use the fraud number on the back of your card or on your bank’s website. Tell the representative to cancel the card and block further activity on the account. That phone call is what starts the clock on your legal protections, so make it before you gather receipts, tally charges, or draft anything in writing.
While you’re on the phone, write down the date, the time, the representative’s full name, and a case or reference number. Banks sometimes dispute when a customer first reported a problem, and that reporting date is what fixes your liability tier under federal law.
Follow Up in Writing Within 10 Business Days
A phone report is enough to trigger the investigation, but your bank can require written confirmation within 10 business days. If the bank told you written notice was required and you don’t send it, the bank isn’t obligated to give you a provisional credit while it investigates. Send the written notice every time, whether or not the phone rep mentioned it.
The notice should identify you and the account, list the transactions you believe are unauthorized with dates and amounts, and explain why you think there’s an error. Mail is fine, but sending it through the bank’s secure message system or by email creates a timestamped record. Keep copies of everything.
The outer deadline is 60 days after the bank sends the statement that first showed an unauthorized charge. Miss that, and you lose federal protection for any fraudulent charges that hit the account after those 60 days expire.
How Much You Can Be Held Liable For
The EFTA sets a tiered liability structure that gets worse the longer you wait.
- Report within 2 business days of learning the card was lost or stolen: maximum liability is $50, or the total unauthorized transfers before you reported, whichever is less.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report after 2 business days but before 60 days from the statement: maximum liability rises to $500.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report more than 60 days after the statement showing the first unauthorized charge: no cap on losses for anything taken after that window closed.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
The statute allows extensions for “extenuating circumstances” such as hospitalization or extended travel, in which case the deadlines become whatever is reasonable under the situation. Don’t plan around that exception.
When the Card Itself Wasn’t Lost or Stolen
The $50 and $500 tiers apply specifically when the physical card or PIN was lost or stolen. If someone got your card number through a data breach, a skimmer, or an online hack and the card is still in your wallet, only the 60-day rule applies. Report the charges within 60 days of the statement that first showed them and you owe nothing. Wait longer, and you’re exposed to unlimited losses on charges appearing after the 60 days expire.2Consumer Financial Protection Bureau. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers
This distinction matters. Card-not-present fraud is now far more common than someone physically pocketing a card, and if your card is still with you, your position under federal law is actually stronger, provided you report on time.
Zero-Liability Policies From Visa and Mastercard
The federal caps are a floor. Visa and Mastercard both offer zero-liability policies that go further. Under Visa’s policy, you’re not held responsible for unauthorized debit card charges whether they occur online or in person, and the issuer must replace the funds within five business days of your report.3Visa. Visa Zero Liability Policy Mastercard’s policy similarly covers unauthorized transactions in stores, online, by phone, on mobile devices, and at ATMs.4Mastercard. Mastercard Zero Liability Protection Policy
The catches: both require you to have used reasonable care with the card and to report promptly. Neither covers commercial cards or anonymous prepaid cards. Visa also notes that provisional replacement funds can be withheld or rescinded based on the investigation, delayed reporting, or account history. These are private policies, not federal rights, so you can’t sue to enforce them the way you can enforce EFTA. In practice, though, most consumers with a major-network debit card end up paying nothing on fraud reported quickly.
What the Bank’s Investigation Looks Like
Once your notice of error reaches the bank, it has 10 business days to investigate and reach a conclusion. For accounts open less than 30 days, that initial window is 20 business days.5Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction
If the bank can’t finish inside that window, it can extend the investigation to 45 calendar days, but only if it first issues a provisional credit to your account for the disputed amount so you can access the money while the review continues. The extension stretches to 90 calendar days for three specific situations: transactions initiated outside the United States, point-of-sale debit card purchases, and transactions on accounts open less than 30 days.6Consumer Financial Protection Bureau. Regulation E – 1005.11 Procedures for Resolving Errors
The bank must report its findings to you within three business days of completing the investigation. If the charges were unauthorized, any provisional credit becomes permanent, and the bank must also refund any fees the fraud triggered, such as overdraft or NSF fees on withdrawals caused by the fraudulent charges. Fees you would have been charged anyway don’t get refunded.6Consumer Financial Protection Bureau. Regulation E – 1005.11 Procedures for Resolving Errors
If the bank decides no error occurred, it will reverse the provisional credit. Before debiting your account, it must give you written notice of the date and amount, and it must honor checks and preauthorized payments from the account for five business days after that notice to prevent a cascade of bounced payments.
If the Bank Denies Your Claim
Denials happen more often than people expect, and a denial letter isn’t the end. Ask the bank for the documents it relied on in reaching that conclusion. You’re entitled to understand the basis for the decision.
If the reasoning doesn’t hold up, or if the bank missed a required timeline (the investigation deadlines, the provisional credit requirement, or the three-day notification rule), file a complaint with the Consumer Financial Protection Bureau, either online at consumerfinance.gov or by calling (855) 411-2372. The CFPB forwards the complaint to the bank, which generally must respond within 15 days, with up to 60 days for complex cases.7Consumer Financial Protection Bureau. Learn How the Complaint Process Works The complaint enters the CFPB’s public database.
You can also complain to the Office of the Comptroller of the Currency if your bank is a national bank, or to your state attorney general. For larger sums, a consumer protection attorney is worth talking to, because the EFTA allows recovery of actual damages, statutory damages, and attorney’s fees when a bank violates its obligations.
A Note on Business Debit Cards
Everything above applies to personal accounts. The EFTA defines a covered account as one established primarily for personal, family, or household purposes, so business accounts fall outside its liability caps and investigation timelines entirely.8Office of the Law Revision Counsel. 15 USC 1693a – Definitions Business disputes are governed by UCC Article 4A, which imposes its own duties on the account holder, including reporting within a reasonable time not exceeding 90 days and a one-year outer bar on challenges.9Legal Information Institute. UCC Article 4A – Funds Transfer The Visa and Mastercard zero-liability policies also exclude commercial cards. If the card in question is a business card, your deposit agreement is your primary protection, and the terms vary a lot between banks.
Reducing the Risk of the Next One
Review transactions at least weekly through your bank’s app or online banking. Waiting for a paper statement is how people blow past the 60-day reporting deadline. Set up transaction alerts so you get a text or email for any purchase above a low threshold like $1; most fraud rings run a small test charge before the larger hits.
Use a PIN that isn’t tied to a birthday, address, or other guessable number. Don’t enter your PIN on a terminal that looks altered or loose. For online purchases, consider using a credit card instead of a debit card: liability for unauthorized credit card charges is capped at $50 under the Truth in Lending Act with no escalating tiers, and most issuers voluntarily offer $0 liability.10Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Because a credit card dispute involves the issuer’s money rather than cash already gone from your checking account, you avoid the cash-flow squeeze that debit fraud creates while the investigation plays out.