If an unauthorized charge shows up from a tap of your card or phone, your maximum exposure depends on which federal law covers the payment method: contactless payment liability for a credit card is capped at $50 under the Truth in Lending Act no matter when you report, while a debit card falls under the Electronic Fund Transfer Act, which uses a time-sensitive ladder that can run to unlimited loss if you wait too long. The practical takeaway is simple. Credit cards give you a legal ceiling and plenty of time. Debit cards give you a clock.
Credit Card Liability Is Capped at $50
If someone steals your contactless credit card and starts tapping, federal law limits your exposure to $50 total, regardless of how long it takes you to notice.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card The Truth in Lending Act sets that ceiling as long as the card issuer met baseline requirements like providing you a way to report the loss. There is no two-day window, no 60-day deadline, and no scenario under the statute where you face unlimited liability on a credit card.
In practice, even the $50 is theoretical for most people. Every major card network runs a voluntary “Zero Liability” program that waives the $50 as long as you weren’t grossly negligent. Those policies go beyond what the law requires, but they are contractual rather than legal rights, which means the network can modify them.
Debit Card Liability Depends on How Fast You Report
Debit cards follow a different and much less forgiving statute. The Electronic Fund Transfer Act and its implementing regulation, Regulation E, tie your maximum loss to how quickly you tell the bank.2eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report within 2 business days of learning of the loss or theft: your liability is capped at $50, or the amount of unauthorized transfers before you notified the bank, whichever is less.
- Report after 2 business days but within 60 days of the statement showing the first unauthorized transfer: liability can reach $500. It covers transfers that occurred after the two-day window and that the bank can show would have been prevented by earlier notice.
- Report after 60 days: you face potentially unlimited liability for transfers that happen after the 60-day period ends, if the bank can show timely reporting would have stopped them.3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
The unlimited-liability tier is where people get hurt. A stolen debit card drains actual cash from your checking account, not a credit line, and while the bank investigates you may not have access to those funds. That gap between the money leaving and the money coming back is the single biggest reason a contactless purchase on a credit card carries less financial risk than the same tap on a debit card.
Mobile Wallets Shift the Risk Picture
A phone, watch, or other wearable paying through Apple Pay, Google Pay, or Samsung Pay stores a tokenized version of your card and requires you to authenticate with a fingerprint, face scan, or passcode before the chip will transmit. A thief who grabs the device still needs your biometric or code to use it. That built-in gate is why mobile wallets offer more day-to-day protection against unauthorized use than a plain plastic contactless card, which anyone holding it can tap up to the terminal’s verification threshold.
The underlying card inside the wallet still belongs to whichever liability regime it came from. A debit card loaded into Apple Pay still falls under Regulation E if an unauthorized transaction goes through; a credit card still falls under the Truth in Lending Act. The wallet changes how easily a thief can use the card, not which federal statute governs the fallout.
What to Do the Moment a Card or Device Goes Missing
Speed matters most for debit cards, because the clock on your maximum liability starts the moment you learn of the loss. Call your bank’s fraud line right away. Most banks publish a 24-hour number on their website and inside their mobile app.
Follow the phone call with a written notice. An email, a secure message through the bank’s app, or a mailed letter all work. Include the date you discovered the loss and any unauthorized transactions you have already identified. That written record is what protects you later if there is any disagreement about when you reported.
For a lost phone or watch, you can remotely disable the device’s payment capability through Apple’s “Find My” feature or Google’s device manager. Because the wallet transmits a token rather than your real card number, cutting off the device shuts down the NFC function without canceling the underlying card.
Disputing a Charge That Isn’t Outright Fraud
Not every bad charge is theft. A duplicate tap, a billed item that never arrived, or a math error on the statement is a billing error, and on a credit card the Fair Credit Billing Act gives you the right to challenge it.4Federal Trade Commission. Using Credit Cards and Disputing Charges
The process has a hard deadline: your written dispute must reach the card issuer within 60 days of the statement that first showed the error. Send it to the address the issuer designates for billing inquiries, not the payment address. Include your name, account number, and a description of the problem, along with copies of any receipts. Certified mail gives you proof of delivery if the issuer later claims they never received the letter.4Federal Trade Commission. Using Credit Cards and Disputing Charges
Once the issuer receives your dispute, it must acknowledge the letter in writing within 30 days and resolve the matter within 90 days. During the investigation you can withhold payment on the disputed amount without being reported as delinquent or having the account closed. You still owe any undisputed balance.
For disputes about the quality of goods or services bought with a credit card, federal law lets you raise the same defenses against the card issuer that you could raise against the seller. Two conditions apply: the purchase must have been over $50, and it must have occurred in your home state or within 100 miles of your billing address. Those geographic limits don’t apply if the seller and the card issuer are the same entity.4Federal Trade Commission. Using Credit Cards and Disputing Charges
Debit card errors are handled under Regulation E rather than the Fair Credit Billing Act, which is one more reason the choice of card at checkout shapes what happens weeks later.
How Worried Should You Be About Skimming?
The fear of “digital pickpocketing,” where someone holds a hidden reader near your pocket to skim a contactless card, gets more attention than it deserves. Experts debate how widespread sophisticated RFID skimming actually is in practice, and the consensus leans skeptical. A criminal would need to stand within inches of the card, and even then would capture only a one-time token rather than a reusable card number.
Relay attacks, in which a device intercepts your NFC signal and forwards it to a distant terminal, are technically possible in lab settings but face real-world obstacles. Each contactless transaction generates a unique authentication code that expires immediately after use, the transmitted data doesn’t include your actual card number, and the sub-four-centimeter communication range makes interception difficult without being conspicuously close to your card or phone.
The bigger real-world risks are lower-tech: a shoulder-surfed PIN, a card lifted from a bag, or a phishing email. If skimming specifically worries you, a mobile wallet gives you an extra lock, because a thief would need both your device and your fingerprint or face. And whichever form factor you use, the liability rules above are what decide how the loss ultimately lands.