When you dispute a fraudulent charge, federal law puts the burden of proof on the card issuer or bank, not on you. In a credit card fraud dispute, the burden of proof sits with the issuer to show the transaction was authorized; you do not have to prove you didn’t make the charge. The same rule applies to debit cards and other electronic transfers through a parallel statute. What differs between the two is how much you can be held liable for if the bank meets that burden, and how quickly you have to act to keep your protections intact.
What the Bank Has to Prove
For credit cards, 15 U.S.C. § 1643 states that in any action to enforce liability for credit card use, “the burden of proof is upon the card issuer to show that the use was authorized.”1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card The debit card equivalent, 15 U.S.C. § 1693g, places the identical burden on the financial institution for unauthorized electronic fund transfers.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability You start the dispute on defense, not on offense.
In practice, the bank’s investigators pull whatever evidence of authorization they can find: IP address logs for online purchases, PIN entry records at terminals, signed receipts, ATM or merchant camera footage, and geolocation data. If that evidence isn’t enough to show you authorized the charge, federal law requires the bank to absorb the loss and credit your account.
Neither statute names a specific evidentiary standard like “preponderance of the evidence.” The civil default is preponderance, meaning more likely than not, but the practical takeaway is simpler: the bank must affirmatively show authorization. Silence or uncertainty in the record breaks in your favor.
Federal law defines “unauthorized use” of a credit card as use by someone other than the cardholder who lacks actual, implied, or apparent authority, and from which the cardholder receives no benefit.3Office of the Law Revision Counsel. 15 USC 1602 – Definitions and Rules of Construction Both halves matter. A stranger who stole your card number and bought electronics on the other side of the country clearly meets that test. Close relationships and household spending are where the arguments start.
What You Could Owe If the Bank Meets Its Burden
The maximum you can be held responsible for depends on which kind of card was used and, for debit cards, how fast you reported the problem.
Credit Cards: $50 Ceiling, Often $0
Under 15 U.S.C. § 1643, your maximum liability for unauthorized credit card use is $50, and that ceiling applies only when the issuer met a set of conditions: you accepted the card, the issuer told you about your potential liability, the issuer provided a means to identify the authorized user, the issuer gave you a way to report loss or theft, and the unauthorized use happened before you notified the issuer.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Miss any one condition and your liability drops to $0.
When only your card number is stolen and the physical card stays in your wallet, your liability is $0 regardless. The issuer cannot meet the identification-method requirement for a transaction where no physical card was presented. Federally, that means online fraud using a stolen credit card number carries zero consumer liability.
Debit Cards: Tiered by How Fast You Report
Debit card liability is structured to reward speed. Notify your bank within two business days of learning about the unauthorized transfer, and your liability is capped at $50 or the actual unauthorized amount, whichever is less.4eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section 1005.6 Report after two business days but within 60 days of the statement showing the transaction, and your liability rises to as much as $500. Wait more than 60 days from the statement date, and you can be on the hook for the full amount of any unauthorized transfers occurring after that 60-day window closes.
This is the sharpest split between the two systems. Credit cards cap your exposure at $50 no matter how long you take. Debit cards can leave you exposed for the entire loss if you stop reading your statements.
Network Zero-Liability Policies
Most consumers never pay even the $50 the statute allows. Visa and Mastercard both maintain zero-liability policies that eliminate consumer responsibility for unauthorized transactions on their branded cards. Visa’s policy covers in-store, online, and phone purchases and requires issuers to replace stolen funds within five business days of notification.5Visa. Visa Zero Liability Policy Mastercard offers substantially the same protection.6Mastercard. Mastercard Zero Liability Protection Both are contractual, not statutory. Both exclude certain commercial and anonymous prepaid cards, and both require reasonable care and prompt reporting.
How to Preserve the Burden Shift
The burden of proof only helps you if you invoke it correctly. The dispute procedures under Regulation Z (credit cards) and Regulation E (debit cards) have real deadlines, and blowing them can cost you the protection.
For a credit card billing error, send a written notice to your issuer within 60 days of the date the issuer sent the statement showing the disputed charge. The notice must go to the specific address the issuer designated for billing disputes, and it must include your name and account number, identify the charge, and explain why you believe it’s an error.7eCFR. 12 CFR 1026.13 – Billing Error Resolution Some issuers accept electronic submissions if they’ve said so in their billing rights statement; otherwise, put it in writing.
Once your notice arrives, the issuer must acknowledge in writing within 30 days (unless it resolves the dispute in that window) and must complete its investigation within two complete billing cycles, and no more than 90 days.8Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors During that period, the issuer cannot try to collect the disputed amount or report it as delinquent.
For debit cards, notify your bank as soon as you spot the transaction. The two-business-day tier and the 60-day outer deadline both run from when you learn of the problem or receive the statement, so a delay isn’t just poor practice; it moves you into a worse liability bracket. Regulation E requires the bank to accept oral notice, though written follow-up is often requested.
Where “Unauthorized” Gets Contested
Straightforward stranger fraud rarely turns on the burden of proof. The bank checks its evidence, comes up short, and credits your account. The disputes that actually get litigated involve people the bank can plausibly connect to you.
If you handed your card to a family member last year and they used it again without asking this year, the bank may argue that person had apparent authority based on the earlier pattern. If a household member used your card for groceries, the bank may argue you received a benefit from the purchase even without authorizing it. Either argument, if it succeeds, takes the transaction out of the “unauthorized use” definition entirely.
There is also what card networks call “friendly fraud,” where a real cardholder makes a purchase and later disputes it. The bank’s burden of proof doesn’t change, but shipping addresses, device fingerprints, and prior purchase history from the same cardholder give the bank the evidence it needs to carry that burden. Repeat disputers face closer scrutiny, account closure, or denial of future claims.
Business Accounts Are Outside These Rules
Don’t assume any of this applies to a business account. The Electronic Fund Transfer Act covers only accounts established primarily for personal, family, or household purposes.9Office of the Law Revision Counsel. 15 USC 1693a – Definitions Business checking accounts fall outside that definition, so Regulation E’s liability caps, provisional credits, and timelines don’t apply to them.10FDIC. Do Consumer Laws Apply to My Business Accounts Whatever fraud protection you have on a business bank account comes from your deposit agreement.
Business credit cards sit closer to the consumer side. The $50 Regulation Z cap applies to organizations that hold credit cards, but when an issuer provides 10 or more cards to an organization for employee use, the issuer and the organization can contractually agree to different liability terms.11Consumer Financial Protection Bureau. 12 CFR 1026.12 – Special Credit Card Provisions The individual employee always keeps the $50 cap regardless of what the employer signed.
If the Bank Rules Against You
A denial isn’t the end of the road. Start by asking for the documents the bank relied on. Under Regulation E, the bank must promptly provide copies on request.12eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section 1005.11 The file often shows the bank’s “evidence” is thinner than the denial letter suggested. A correct PIN entry, for example, doesn’t prove the cardholder was the one who entered it.
File a CFPB Complaint
If the bank didn’t follow the dispute procedures or you believe the outcome is wrong, file a complaint with the Consumer Financial Protection Bureau. The CFPB routes the complaint to the institution, which generally must respond within 15 days. Submissions go through the CFPB website or by phone at (855) 411-2372.13Consumer Financial Protection Bureau. Submit a Complaint Attach statements and your correspondence with the bank. The CFPB generally doesn’t allow a second complaint on the same issue, so make the first one complete.
Issuer Penalties for Procedural Failures
Under the Truth in Lending Act, if a credit card issuer doesn’t acknowledge your dispute within 30 days, takes more than two billing cycles to resolve it, or threatens to report missed payments during the dispute period, the issuer forfeits its right to collect up to $50 of the disputed amount, even if the charge turns out to be valid.8Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
Statutory Damages and Attorney’s Fees
Both statutes give consumers a private right of action. Under the EFTA, you can sue for actual damages plus statutory damages between $100 and $1,000 per violation, plus attorney’s fees if you win.14Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability Under TILA, statutory damages for open-end credit violations range from $500 to $5,000, plus actual damages and attorney’s fees.15Office of the Law Revision Counsel. 15 USC 1640 – Civil Liability The fee-shifting provisions matter: they make these cases worth taking even when the disputed amount is small.