Are Debit Cards Protected From Fraud? Liability Tiers and Deadlines

If someone uses your debit card without permission, federal debit card fraud liability rules cap what you owe based on how quickly you tell your bank. Report a lost or stolen card within two business days and you can be held responsible for no more than $50. Wait longer than two business days and that ceiling rises to $500. Wait more than 60 days after the bank sends the statement showing the fraud, and you can lose federal protection entirely for any unauthorized transfers that happen after that 60-day mark. Speed is the whole game.

The Three Liability Tiers Under Federal Law

The Electronic Fund Transfer Act and its Regulation E set the rules for unauthorized debit card transfers.¹ The clock starts either the moment you learn your card is lost or stolen, or the moment your bank sends a statement showing an unauthorized charge, depending on the situation.²

Within 2 business days of learning your card is lost or stolen: your liability is capped at the lesser of $50 or the amount actually taken before you notified the bank. If a thief charged $30 before you called, you owe at most $30.
After 2 business days but within 60 calendar days of your statement: the ceiling rises to $500. The bank can hold you responsible for unauthorized transfers that happened after the two-day window closed but before you reported, up to that cap.
After 60 calendar days from the statement showing the first unauthorized transfer: you lose federal protection for any unauthorized transfers that occur after that 60-day mark, until you finally report. That exposure can drain your checking account and any linked overdraft line.²

Business days are days the bank is open for substantially all of its functions. A Saturday when the branch handles teller work but doesn’t run error investigations doesn’t count. Sundays and federal holidays almost never count.³ A card stolen on Friday evening effectively gives you until the following Wednesday to stay inside the two-day window.

If something outside your control — a hospital stay, extended travel — kept you from reporting on time, the bank has to extend the deadlines to a reasonable period. That extension is written into the regulation, not left to the bank’s discretion.⁴

Visa and Mastercard layer their own zero liability policies on top of the federal floor, and those policies can be more generous. Both cover unauthorized transactions when you’ve used reasonable care and reported promptly, but both exclude certain commercial cards and unregistered prepaid cards.⁵⁶ These are contractual policies between the network and your bank rather than legal rights, and they can only add to what federal law gives you, never subtract from it.¹

When Only Your Card Number Was Stolen

The $50 and $500 tiers apply when the physical card itself (the “access device”) is lost or stolen. If a thief gets only your card number through a data breach, a skimmer, or an online hack, those first two tiers don’t apply. Report the fraudulent charges within 60 days of the statement that shows them and your liability is zero. The only real risk is waiting past that 60-day mark, at which point you become responsible for any unauthorized transfers occurring after the deadline until you notify the bank.⁷ Card-number-only theft is by far the more common scenario, so most fraud victims fall under this rule rather than the two-day one.

What Counts as an “Unauthorized” Transfer

Not every charge you didn’t want qualifies as unauthorized under the law. An unauthorized transfer is one initiated by someone other than you, without your permission, and from which you received no benefit. Two situations trip people up:

If you gave someone your card or PIN and they misused it, the law does not treat those charges as unauthorized unless you had already told your bank to revoke that person’s access.
Transfers you initiated yourself don’t qualify, even if you were pressured into them through a scam. When a scammer convinces you to send money, you sent it — that’s a scam loss, not fraud liability the bank has to reverse.

What to Do the Moment You Spot Fraud

Every hour you wait is time a thief can drain the account, and each day past the two-business-day window can shift your potential liability by an order of magnitude.

Call your bank. Use the number on the back of your card or on the bank’s website. Most banks staff a 24-hour fraud line, and verbal notification starts the clock even outside normal business hours.
Lock or freeze the card in your banking app. This blocks new transactions while the claim is sorted out.
Provide written confirmation if the bank asks for it. Under Regulation E the bank can require written confirmation within 10 business days of your phone call, and if you don’t send it (and the bank told you about the requirement), the bank can stop investigating.⁸
Document the call. Note the date and time you discovered the fraud, when you called, the representative’s name, and any reference number. If a dispute later arises about when you reported, this record is your defense.
Read the full statement. Thieves who hit an account once often return. Look for small test charges that may have preceded the larger ones.

How the Bank Must Handle Your Claim

Regulation E gives the bank 10 business days from receiving your report to investigate and reach a conclusion. If it confirms an error, it has to correct it within one business day. For accounts opened within the last 30 days, that initial investigation window stretches to 20 business days.⁹

If the bank needs more time, it can take up to 45 days total, but only if it puts a provisional credit into your account within the first 10 business days. That credit has to cover the full disputed amount plus any applicable interest, though the bank can withhold up to $50 if it has a reasonable basis for believing the transfer was unauthorized and the card was an accepted access device. The bank has to tell you the amount and date of the provisional credit within two business days of issuing it, and you get full use of those funds while the investigation continues.⁹

The 45-day window stretches to 90 days in three situations: the transfer wasn’t initiated in the United States, it came from a point-of-sale debit card transaction, or it involved a new account within the first 30 days. Foreign transactions and point-of-sale fraud are the common triggers.

When the bank confirms fraud, it has to do more than refund the stolen amount. It also has to refund any fees the unauthorized transfer caused, including overdraft fees, and credit any interest you lost. If a thief’s $800 withdrawal triggered a $35 overdraft fee, the bank owes you both.¹⁰

If the Bank Denies Your Claim

Banks deny fraud claims more often than people expect, especially when a PIN was used or when the bank’s system flagged the transaction as consistent with your normal spending. A denial is not the end of the road.

If the bank concludes no error occurred, it has to give you a written explanation and tell you about your right to request the documents it relied on. The bank has to hand over copies of those documents promptly when you ask.¹¹ Sometimes the investigation is thin. Banks may lean on IP address or geolocation data that doesn’t actually prove you authorized the charge. If provisional credit was issued and the bank now wants to reverse it, the bank still has to honor your checks and preauthorized transfers for five business days after notifying you, without charging overdraft fees on those items.

If you think the bank violated Regulation E — by missing a deadline, failing to issue provisional credit, or not giving you a written explanation — file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or (855) 411-2372. The CFPB forwards your complaint to the bank, which generally has to respond within 15 days. You then get 60 days to review the response.¹²

Where These Rules Do Not Apply

The liability limits above cover consumer accounts. A few situations fall outside them:

Business debit cards. If your card is tied to a commercial checking account, the EFTA and Regulation E do not cover you. Business account disputes fall under the Uniform Commercial Code (Article 4A in most states) and your deposit agreement with the bank, which typically offers far less protection and may require you to detect and report fraud within a single business day to preserve your rights.¹³ Sole proprietors using a personal checking account for business likely still qualify for EFTA protection, but confirm the account classification with your bank.

Prepaid cards. General-purpose reloadable prepaid cards are covered by Regulation E, but full protection depends on whether you’ve registered the card by verifying your identity. Unregistered cards still get the basic liability limits, but the bank does not have to issue provisional credit during its investigation. Once you register, the bank has to treat your dispute like any standard debit card claim.¹⁴

Payroll cards. Employer-issued payroll cards get a longer reporting window: 120 days after the unauthorized transfer posts, rather than the standard 60 days from the statement date. This accounts for the fact that many payroll cardholders don’t receive traditional periodic statements.¹⁵

1
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
2
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
3
Consumer Financial Protection Bureau. 12 CFR 1005.2 – Definitions
4
eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) – Section 205.6
5
Visa. Visa Credit Card Security and Fraud Protection
6
Mastercard. Mastercard Zero Liability Protection for Unauthorized Transactions
7
eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E)
8
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section 1005.11
9
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
10
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Supplement I, Section 1005.11
11
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
12
Consumer Financial Protection Bureau. Submit a Complaint
13
Legal Information Institute. UCC Article 4A – Funds Transfer
14
Consumer Financial Protection Bureau. Know Your Rights
15
National Credit Union Administration. Electronic Fund Transfer Act (Regulation E)