When a thief runs up charges on your credit card, federal law caps what you personally owe at $50, and the major card networks almost always waive that too, so in practice you pay nothing. The actual bill for stolen credit card purchases lands on either the card issuer or the merchant, and which one pays depends on the technology used to process the transaction. The system is built to keep the loss off the cardholder and push it toward whichever business had the weaker fraud controls.
What You Personally Owe
The Truth in Lending Act sets your maximum liability for unauthorized credit card charges at $50, no matter how much the thief spent.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card That ceiling applies only if the issuer gave you notice of your potential liability, provided a way to report the loss, and the fraudulent charges happened before you told them. Report the card lost or stolen before any bad charges hit, and your liability is zero.
If the physical card never left your wallet — a number stolen through a data breach or online skimmer, for example — you owe nothing under federal law. The statute only limits liability when there’s an “unauthorized use,” which the implementing regulation defines as use by someone with no actual, implied, or apparent authority from which you get no benefit.2eCFR. 12 CFR 1026.12 – Special Credit Card Provisions The $50 cap covers purchases and cash advances alike; the law draws no line between them.
The major card networks go further. Visa, Mastercard, American Express, and Discover all publish zero liability policies that erase even the $50 exposure for most cardholders. Visa says cardholders “won’t be held responsible for unauthorized transactions” whether the card was lost, stolen, or used fraudulently.3Visa. Zero Liability Mastercard extends the same protection to purchases in stores, by phone, online, on mobile devices, and at ATMs.4Mastercard. Zero Liability Protection
These policies come with two conditions. You have to use reasonable care to protect the card (writing your PIN on it, for instance, can disqualify you), and you have to report unauthorized activity promptly once you notice it. Because zero liability is a network policy rather than a statute, the networks can change the terms — but market pressure has kept them consumer-friendly for years.
Which Business Actually Eats the Loss
Once you’re cleared, the money still has to come from somewhere. Since October 2015, the EMV chip liability shift has assigned that cost to whichever party to the transaction had the weaker security technology. If a merchant swipes a chip card through a magnetic-stripe-only terminal and the transaction turns out to be fraudulent, the merchant pays. If the merchant has a chip-enabled terminal but the bank issued a card without a chip, the bank pays.5Mastercard. EMV/Chip Frequently Asked Questions for Merchants
Online and phone purchases follow a different path because no physical card is present. In those cases the merchant usually absorbs fraud losses unless it verified the buyer through a secure authentication method such as 3D Secure. When a transaction runs cleanly through a fully compliant chip terminal and still turns out to be fraudulent, the bank generally takes the hit. The structure pushes both sides to invest in stronger security: merchants upgrade their terminals, banks issue chip cards, and each one tries to shift the loss to the other.
Situations That Can Push the Loss Back Onto You
A few scenarios move liability off the bank or merchant and back onto the cardholder. The main ones involve authorized users, business cards, and reporting delays.
People You Gave Access To
Regulation Z defines “unauthorized use” as use by someone without actual, implied, or apparent authority from whom you get no benefit.2eCFR. 12 CFR 1026.12 – Special Credit Card Provisions Hand your card to a family member for groceries and they instead spend the afternoon shopping, and you are generally on the hook for what they charged, because you gave them authority to use the card. The issuer treats that as a personal dispute between you and the user, not fraud.
To cut off liability for someone you previously authorized, tell the issuer they no longer have permission. Until you do, the issuer can hold you responsible for charges that person makes, even if they exceed limits you set verbally.6Consumer Financial Protection Bureau. Regulation Z – 1026.12 Special Credit Card Provisions If the issuer sent cards to authorized users at your request, up to $50 of liability for unauthorized use of those additional cards can also be assigned to you.
Business and Corporate Cards
When a company gets ten or more cards from a single issuer, the issuer and the company can negotiate liability terms that override the standard $50 cap, meaning the business may accept greater responsibility for fraud losses. An individual employee’s personal liability still can’t exceed the federal limits.6Consumer Financial Protection Bureau. Regulation Z – 1026.12 Special Credit Card Provisions Visa and Mastercard also carve certain commercial cards out of their zero liability policies.3Visa. Zero Liability Small-business cards issued to individual owners usually keep the same consumer protections; large corporate programs may not.
Missing the Reporting Deadline
The Fair Credit Billing Act gives you 60 days from the date the issuer sent the statement containing the fraudulent charge to submit a written dispute. Miss it and the issuer has no legal duty to investigate.7Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Reviewing every monthly statement matters for that reason alone.
Debit Cards Follow Different Rules
If you’re reading this about a debit card, the answer changes. Debit card fraud is governed by the Electronic Fund Transfer Act, and protection depends entirely on how fast you report. Within two business days of learning about the loss, liability is capped at $50. Between two and 60 days after the statement is sent, it can climb to $500. After 60 days, liability for new unauthorized transfers is unlimited.8GovInfo. 15 USC 1693g – Consumer Liability
Debit card fraud also drains real money from your checking account while the bank investigates, which can leave you short on rent or bills. Credit card fraud is a fight over the issuer’s money, so your cash flow stays intact. Many banks voluntarily apply zero liability to debit cards, but they aren’t required to, and those voluntary policies often have tighter reporting windows.9FDIC.gov. VI-2 Electronic Fund Transfer Act
What to Do the Moment You Notice Fraud
Speed decides how much of the loss stays with the bank or merchant versus creeping back to you. The steps in order:
- Call the number on the back of the card or on your most recent statement. Most issuers run 24/7 fraud lines, and once you make that call, you have zero liability for any charges that happen afterward.
- Freeze the card in your banking app while you wait. Most apps let you lock it instantly so no new charges can go through.
- Go through recent statements and flag every charge you don’t recognize. Write down the merchant name, date, and amount for each one.
- File a police report on the non-emergency line. Many issuers ask for a report number when processing a fraud claim.10Office of the Comptroller of the Currency (OCC). Credit Card and Debit Card Fraud
How the Formal Dispute Works
Under the Fair Credit Billing Act, your written notice has to reach the address your issuer designates for billing inquiries — usually different from the payment address on the statement — within 60 days of the statement date. The address is in your cardholder agreement and typically on the statement itself. Certified mail with a return receipt gives you proof of timely delivery. Most issuers also take disputes online or by phone, though writing is the only method the statute explicitly requires.
Once your notice arrives, the issuer must acknowledge it in writing within 30 days. It then has two full billing cycles, capped at 90 days total, to either correct the error or send a written explanation of why the charge stands.11Consumer Financial Protection Bureau. Regulation Z – 1026.13 Billing Error Resolution During the investigation, the issuer can’t try to collect the disputed amount or related finance charges, and you don’t have to pay that portion of your bill.
Some issuers post a temporary credit while they look into the charge, but federal law does not require it for credit card disputes. (Debit card disputes under Regulation E do require provisional credit within 10 business days.) If the issuer decides the charge was legitimate, it will reverse any temporary credit and notify you in writing, and you can request copies of the documentation it relied on. The Fair Credit Billing Act also bars the issuer from reporting the disputed amount as delinquent to the credit bureaus while the investigation is open.12Federal Trade Commission. Fair Credit Billing Act
Keep copies of every document: the police report, your dispute letter, confirmation numbers from the issuer, and any correspondence. If the investigation stalls or the issuer pushes back, that paper trail is what keeps the loss where it belongs — with the bank or the merchant, not you.