Federal law caps your personal liability for credit card fraud at $50 per card, and in most cases you end up paying nothing. The Truth in Lending Act, as amended by the Fair Credit Billing Act, sets that ceiling and gives you a written dispute process that forces your issuer to investigate, pause collection, and credit your account if the charges weren’t yours. The catch is that the protections run on deadlines. Miss them and you can lose the leverage the statute was designed to give you.
The $50 Federal Cap
Under 15 U.S.C. § 1643, the most you can owe for unauthorized credit card charges is $50, no matter how much the thief actually spent.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card If someone runs up $8,000 before you catch it, your exposure is still $50.
And even that $50 only applies when the issuer has met specific conditions. The card has to be one you agreed to accept, the issuer must have told you about your potential liability, and the issuer must have given you a way to report loss or theft. Fall short on any of those and your liability drops to zero.2Consumer Financial Protection Bureau. Regulation Z 1026.12 – Special Credit Card Provisions If you report a card lost or stolen before any fraudulent charges post, you owe nothing for charges made after that notification.
Card-not-present fraud works even more in your favor. When a thief steals only your account number, the physical card never left you, and the statute requires the issuer to have provided a way to identify the authorized user at the point of sale, a condition that is nearly impossible to satisfy without the card itself. In practice, your liability for pure number theft is $0.3Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
Network Zero-Liability Policies
The $50 cap is the legal floor. Visa and Mastercard both run zero-liability policies that go further than federal law, covering unauthorized purchases made in-store, online, by phone, or on a mobile device. Visa’s policy requires the issuer to replace stolen funds within five business days of notification.4Visa. Visa Zero Liability Policy Mastercard’s policy covers all transaction types and waives cardholder responsibility entirely.5Mastercard. Mastercard Zero Liability Protection for Unauthorized Transactions
Both networks attach conditions. You have to have used reasonable care to protect the card and reported the fraud promptly. Neither network defines “promptly” with a hard number, but waiting weeks after you spot something suspicious gives the issuer room to argue. Certain commercial cards and unregistered prepaid cards like gift cards are excluded. For cards running on other networks, check the cardholder agreement for comparable language.p>
When Someone You Know Uses Your Card
All of this protection depends on the word “unauthorized,” and the term has a narrower meaning than people expect. A stranger stealing your card is unauthorized. Handing your card to a friend or family member for one purchase, only for them to charge something else, usually isn’t.6Consumer Financial Protection Bureau. What Is an Unauthorized Use of a Credit Card? By voluntarily giving someone access, you authorized the use.
To cut off that authorization, you have to tell the issuer the person is no longer permitted to use the card. Charges made after that notification can be treated as unauthorized. Charges made before it are yours.
If You Carry a Company Credit Card
Business cards are governed by a different rule. Under 15 U.S.C. § 1645, when a business has ten or more cards issued to employees from the same issuer, the company and the issuer can negotiate their own liability terms for unauthorized charges.7Office of the Law Revision Counsel. 15 USC 1645 – Business Credit Cards; Limits on Liability of Employees
The part that matters to you personally: no matter what the business and the issuer agree to, your individual liability as an employee cannot exceed the standard $50 cap. Neither your employer nor the issuer can push greater liability onto you.2Consumer Financial Protection Bureau. Regulation Z 1026.12 – Special Credit Card Provisions
How to File a Dispute That Protects You
Calling your bank is a reasonable first step, but a phone call by itself does not trigger the Fair Credit Billing Act’s protections. The statute requires a written notice of billing error, and that is the step most people skip.8Consumer Financial Protection Bureau. Regulation Z 1026.13 – Billing Error Resolution
Your notice should include your name and account number, the date and dollar amount of the suspicious charge, the merchant name as it appears on the statement, and a short explanation of why you believe the charge is fraudulent. A clear statement that you didn’t authorize the purchase is enough. Many issuers provide a dispute form on their website or on the back of the paper statement, and if the issuer’s billing rights notice says it accepts electronic submissions, an online form counts as written notice.
Don’t send the dispute to the payment address. Your statement lists a separate billing inquiries address, and your notice must go there. If you mail a letter, use certified mail with return receipt requested so you have proof of delivery.
The deadline is firm: your written notice must reach the issuer within 60 days of the date the statement containing the error was mailed to you.9Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Missing it doesn’t necessarily end the dispute (the issuer may still handle it voluntarily), but you lose the statutory leverage. Keep copies of everything, including confirmation numbers.
What the Issuer Must Do After You File
Once your written dispute arrives, a statutory clock starts. The issuer has to send you a written acknowledgment within 30 days, unless it resolves the dispute entirely in that window.10Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors After acknowledgment, it has two complete billing cycles to finish the investigation, with a hard cap of 90 days from the date it received your notice.
During the investigation, you can withhold payment on the disputed amount and any related finance charges. The issuer cannot send the disputed portion to collections, report it as delinquent to credit bureaus, or close or restrict your account solely because of the unpaid dispute.9Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors You still owe minimum payments on the undisputed part of your balance. Skipping payments entirely because one charge is in dispute causes real damage to the rest of the account.
If the issuer finds the charge was fraudulent, it has to credit your account and remove related finance charges and fees. If it concludes the charge was legitimate, it has to send you a written explanation and tell you what you owe. At that point you have the right to request copies of the documents the issuer relied on.11Federal Trade Commission. Using Credit Cards and Disputing Charges An issuer that fails to follow these procedures forfeits the right to collect the disputed amount and related finance charges, up to $50.9Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
If Your Dispute Is Denied
A denial doesn’t end the matter. Request the evidence the issuer used, and read it carefully. Issuers sometimes rely on a merchant’s assertion that goods were delivered without much independent verification. If you have evidence that contradicts the findings, such as receipts placing you elsewhere, proof the merchandise never arrived, or records showing an unusual transaction pattern, submit it in writing and ask the issuer to reopen the investigation.
If the issuer refuses to move or didn’t follow the dispute procedures, file a complaint with the Consumer Financial Protection Bureau. Complaints can be submitted online or by phone at (855) 411-2372.12Consumer Financial Protection Bureau. Submit a Complaint Describe the problem with key dates and dollar amounts and upload supporting documents (up to 50 pages). The CFPB sends the complaint directly to the issuer, and companies usually respond within 15 days. You generally cannot file a second complaint about the same problem, so make the first one complete.
Debit Cards Are Not the Same
If the compromised card is a debit card, these protections don’t apply. Unauthorized debit transactions fall under the Electronic Fund Transfer Act, and your liability depends entirely on how fast you report.13Consumer Financial Protection Bureau. Regulation E 1005.6 – Liability of Consumer for Unauthorized Transfers Report within two business days of learning of the loss and liability is capped at $50. Between two and 60 days, it jumps to $500. After 60 days from the statement date, you can be liable for the full amount of unauthorized transfers made after the 60-day window, with no cap.14Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
The money also comes from a different place. A fraudulent credit card charge adds to a balance you haven’t paid. A fraudulent debit card charge pulls cash straight out of your checking account, which can bounce rent checks and trigger overdraft fees while the bank investigates.