Business debit card fraud liability is not capped by federal law the way personal debit card liability is, so how much of an unauthorized charge you can recover depends almost entirely on your deposit agreement with the bank and, secondarily, on the card network’s voluntary zero-liability policy. Regulation E, the rule that limits a consumer’s exposure to $50 when a lost or stolen card is reported quickly, defines “account” as one established for personal, family, or household purposes and defines “consumer” as a natural person.1eCFR. 12 CFR 1005.2 A business checking account fits neither definition, so none of Regulation E’s protections apply to your company’s card.
No Federal Cap on Business Card Losses
Because Regulation E doesn’t reach commercial accounts, a business can be liable for the full amount of any unauthorized transaction. A consumer who reports a stolen personal card within two business days risks losing at most $50.2eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers A business owner facing the same theft has no statutory liability cap and no statutory right to reimbursement.
The FDIC has said this plainly: “While federal law doesn’t protect business debit cards from liability for unauthorized transactions, your bank account agreement and state laws could limit your liability.”3Federal Deposit Insurance Corporation. Will I Be Liable for Unauthorized Transactions Made on Business Credit/Debit Cards UCC Article 4A, sometimes cited for commercial electronic payments, actually governs wire transfers and interbank funds transfers rather than point-of-sale debit card purchases.4Legal Information Institute. UCC 4A-108 – Relationship to Electronic Fund Transfer Act That leaves the deposit agreement as the document controlling liability, notification deadlines, and dispute procedures.
What Your Deposit Agreement Likely Says
Read the agreement before you need it. Most commercial deposit agreements include indemnity language that shifts the loss to the business if the breach originated on the business’s side. If an employee shared a card number, wrote a PIN on a sticky note, or left online banking credentials unsecured, the bank will cite that clause and decline the claim.
Even when the breach isn’t clearly your company’s fault, the bank may argue that its own security procedures were commercially reasonable and therefore the transaction counts as authorized. Under Article 4A’s framework for commercial wire transfers, a bank that follows agreed-upon security procedures is generally treated as having processed a valid order, and many deposit agreements borrow that same standard for debit transactions.5Legal Information Institute. UCC 4A-201 – Security Procedure
Reporting deadlines in these contracts are often far shorter than the windows Regulation E gives consumers, sometimes as little as 24 hours after discovery. Miss that window and you can forfeit the claim regardless of merit. If the contract says 24 hours and you report in 48, the bank has a contractual basis to deny.
Visa and Mastercard Zero Liability Policies
The card networks provide the closest thing to a safety net, but their programs are contractual promises, not statutory rights, and each comes with conditions.
Visa’s Zero Liability policy covers business debit card transactions processed through the Visa network, including online and telephone purchases. It does not apply to ATM transactions, PIN-based purchases not processed over Visa’s system, or “certain commercial card” transactions.6Visa. Zero Liability That last exclusion matters for larger corporate purchasing cards. The account must be in good standing, and the cardholder must have exercised reasonable care in protecting the card.
Mastercard’s Zero Liability Protection covers in-store, telephone, online, mobile, and ATM transactions.7Mastercard. Mastercard Zero Liability Protection for Unauthorized Transactions Mastercard notes that if applicable law imposes greater liability, that law controls instead of the network’s policy.
Both programs require prompt reporting, and each network can deny a claim if the business didn’t take basic precautions. Treat network zero liability as a backup layer, not an automatic refund guarantee.
How to Report Unauthorized Charges
Speed decides most claims. Call the bank’s fraud department first to freeze the card and create an initial record, then follow up in writing the same day. The bank will typically require a formal written statement or affidavit. Expect to provide:
- Transaction details: dates, amounts, and merchant names for each disputed charge
- A discovery timeline showing when you first noticed the activity and how
- Government-issued ID and any account verification the bank requests
- A police report, which many banks require before processing a commercial fraud claim and which strengthens your position even when not required
Some banks require the affidavit to be notarized.
Once you file, the bank investigates. For consumer accounts, Regulation E forces banks to resolve errors within 10 business days or provisionally credit the account while investigating for up to 45 days.8eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors No equivalent rule exists for business accounts. Your bank can take as long as the deposit agreement allows, often 30 to 90 days, with no obligation to make funds available to you during that time. Keep copies of every document you submit and every response you receive. If the claim is denied, that paper trail is your strongest asset.
If the Bank Denies Your Claim
A denial isn’t necessarily the end, but your options narrow compared to a consumer dispute.
Request a written explanation. The bank should identify the evidence it relied on and the deposit agreement provision it applied. Sometimes the denial rests on a missed reporting deadline; sometimes it rests on a security procedure the bank says you failed to follow. Knowing the stated reason tells you whether a factual rebuttal or a contractual argument is the better path.
If your bank is a national bank or federal savings association, you can file a formal complaint with the Office of the Comptroller of the Currency through its Customer Assistance Group. The OCC requires that you first attempt to resolve the issue directly with the bank.9HelpWithMyBank.gov (Office of the Comptroller of the Currency). File a Complaint The OCC can review whether the bank followed its own policies and applicable law, but it cannot award you money or act as your attorney. If your bank is regulated by the FDIC, the Federal Reserve, or a state banking agency instead, you’ll need to file with the appropriate regulator.
Check the deposit agreement for an arbitration clause. Many commercial banking contracts require binding arbitration rather than court, which limits your ability to sue. If the dollar amount justifies it and no arbitration clause blocks the path, a commercial litigation attorney can evaluate a breach-of-contract claim. Some states impose a duty of good faith on banks in commercial relationships that goes beyond what the deposit agreement explicitly says.
Managing Employee Card Access
The most common source of unauthorized business debit card charges isn’t a sophisticated hack. It’s an employee who exceeded their spending authority or used the card for personal purchases. Because the deposit agreement holds the business responsible for transactions made with cards it authorized, internal controls are the front line.
- Set each employee’s spending cap based on actual purchasing needs. Most business banking platforms let you restrict per-transaction, daily, and monthly limits for each card.
- Block card use at merchant categories that don’t match the employee’s role. Someone buying office supplies doesn’t need access to travel or entertainment merchants.
- Require a supervisor senior to the cardholder to review and approve activity, never a peer or subordinate.
- Have each cardholder reconcile their own transactions against receipts before the supervisor reviews them.
- Have every cardholder sign an agreement that spells out permitted uses, spending limits, consequences for misuse, and the obligation to return the card on termination.
Watch for split transactions. An employee who hits a per-transaction limit and breaks a $600 purchase into two $300 charges is circumventing controls.
When an employee misuses a card, the business typically absorbs the loss as far as the bank is concerned. Recovering the money from the employee is a separate employment-law matter that varies by state and usually requires written authorization for payroll deductions. From the bank’s perspective, you gave that person the card.
Deducting Unrecovered Losses on Your Taxes
If you can’t recover stolen funds through the bank or a card-network claim, you may be able to deduct the loss on your business tax return. The IRS treats fraud as a theft loss under Section 165 of the Internal Revenue Code, and business theft losses aren’t subject to the $100-per-event or 10%-of-AGI floors that apply to individuals.10Internal Revenue Service. Publication 547 – Casualties, Disasters, and Thefts
To qualify, the loss must meet three conditions: it must result from conduct that qualifies as theft under your state’s criminal law; you must have no reasonable prospect of recovery, meaning you’ve exhausted the bank, card network, and any insurance claim; and the loss must arise from a business or income-producing activity rather than a personal purchase. If a reimbursement claim is still pending, you can’t deduct the loss yet.
Report the loss on Section B of IRS Form 4684 (Casualties and Thefts), then carry the result to Form 4797 (Sales of Business Property). The deductible amount is your adjusted basis in the stolen funds minus any insurance or other reimbursement received or expected.11Internal Revenue Service. 2025 Instructions for Form 4684 For cash stolen from a bank account, the adjusted basis is the dollar amount taken. Filing a police report isn’t technically required, but it strengthens your position if the IRS questions whether the loss qualifies as theft.