Debit Card Disputes Under Regulation E: Deadlines and Provisional Credit

When you spot an unauthorized charge or error on your debit card, debit card disputes under Regulation E give you a defined set of rights: a capped liability (as low as $50 if you move fast), a strict investigation timeline your bank must follow, provisional credit while the bank looks into things, and the ability to sue or file a federal complaint if the bank drags its feet. The catch is that most of those protections depend on how quickly you report the problem.

What Counts as an Error You Can Dispute

Regulation E covers problems with the electronic transfer itself, not with what you bought. The covered categories include:

Unauthorized transfers, where someone uses your card or account credentials without your permission.
Transfers processed for the wrong amount.
Transfers you made that never showed up on your statement.
Bank bookkeeping mistakes tied to an electronic transfer that leave your balance wrong.
ATM withdrawals where the machine gave you less cash than it debited.

A double charge for a single purchase and an automatic payment that hits after you revoked authorization both qualify.¹

What is not covered: complaints about the quality or delivery of something you paid for. A jacket that arrives damaged is a fight with the merchant, not a Regulation E error. The regulation asks whether the transfer was accurate and authorized, not whether you liked the purchase.

Reporting Deadlines and How Much You Can Lose

Your maximum liability for unauthorized debit card charges depends almost entirely on how fast you tell your bank. There are three tiers, and the drop-offs are steep.

Report within two business days of learning your card was lost, stolen, or compromised, and your liability is capped at $50 (or the total unauthorized charges, if less).²
Report after two business days but within the 60-day statement window, and your liability can reach $500. The bank has to show that the losses above $50 would not have happened if you had reported sooner.²
Fail to report within 60 days after the bank sends the statement showing the unauthorized activity, and your liability becomes unlimited for any further unauthorized transfers after that window closes. That can mean your full checking balance, linked savings, and any overdraft credit line.²

The two-day clock starts when you learn of the problem, not when the transfer actually happened. Real-time transaction alerts are the single easiest way to catch fraud early and stay in the $50 tier.

How to File the Dispute

To open a claim, you give the bank three things: your name and account number, the date and dollar amount of the transaction you’re disputing, and why you believe an error occurred.¹

A phone call is enough to trigger the bank’s legal obligations. The bank can ask you to follow up in writing within 10 business days, though. Miss that written deadline and the bank is allowed to hold off on provisional credit during its investigation, leaving you without the disputed funds for weeks.¹ If you send anything by mail, use certified mail so you have proof of receipt.

Your dispute has to reach the bank within 60 days after it sends the statement on which the error first appeared.³

A few things banks are not allowed to demand before opening an investigation. They cannot make you file a police report first, and they cannot tell you to contact the merchant before they’ll look into it. If a representative gives you either runaround, they’re wrong.⁴

What the Bank Must Do After You File

Once your dispute is in, the bank generally has 10 business days to finish its investigation and tell you what it found. New accounts get a longer window: if the disputed transaction occurred within 30 days of your first deposit, the bank gets 20 business days.¹

Provisional Credit

If the bank can’t finish within that initial window, it has to deposit provisional credit into your account within 10 business days of your notice. The credit equals the full disputed amount plus any interest you would have earned. One narrow exception: if the bank has a reasonable basis to think the transfer was unauthorized and your card was lost or stolen, it can hold back up to $50, reflecting your maximum statutory liability.³

With provisional credit posted, the bank gets an extended investigation window of up to 45 days from when it first received your notice. That stretches to 90 days if the transfer involved a foreign transaction, was a point-of-sale debit purchase, or occurred on an account opened within the last 30 days.¹

After the Investigation

If the bank finds an error, it must correct it within one business day and make any provisional credit permanent. If it finds no error, it must send you a written explanation, tell you the date and amount it will pull back from your account, and let you know you can request the documents it relied on. For five business days after that debit notice, the bank has to honor checks and preauthorized payments without hitting you with overdraft fees, giving you time to adjust.¹

When a Scam Transfer Still Counts as Unauthorized

One tricky area is what happens when a scammer manipulates you into sharing your card number, PIN, or login. The Consumer Financial Protection Bureau has clarified that when a fraudster obtains your credentials through deception and then uses them to initiate transfers, those transfers still count as unauthorized under Regulation E. The scammer initiated the transfer, not you.⁴

Some banks have tried to deny claims by arguing the consumer “gave away” their credentials. The CFPB’s position is that a phished or social-engineered consumer has not voluntarily furnished their access device, and the bank cannot use your negligence as a reason to deny the claim or increase your liability beyond what the regulation allows.⁴

What matters is who pressed the button. If a scammer talks you into sending money yourself, posing as a romantic interest or fake landlord, you initiated that transfer. That’s a much harder claim because the transfer wasn’t “unauthorized” in the regulatory sense. The question is always whether someone other than you initiated the transfer from your account.

If the Bank Denies Your Claim

A denial letter isn’t the end. Start by asking for the documents the bank used to reach its decision. The bank has to provide them promptly and in a form you can actually read; raw transaction logs have to be converted into something understandable.³

Read those documents closely. Banks sometimes deny claims for reasons the regulation doesn’t allow, like the fact that a PIN was used (which could just mean a thief watched you enter it) or that the charge occurred in a city where you happen to live. If the reasoning looks thin, escalate inside the bank and cite the CFPB’s guidance that consumer negligence cannot increase your liability.

If the bank still won’t move, file a complaint with the CFPB. The agency forwards complaints to the company and generally gets a response within 15 days. You usually can’t submit a second complaint on the same issue, so include every relevant fact, date, amount, and copy of correspondence the first time. Complaints can be filed online or by phone at (855) 411-2372, Monday through Friday, 8 a.m. to 8 p.m. Eastern.⁵

Suing Under the EFTA

If a bank violates any provision of the Electronic Fund Transfer Act, including the investigation timelines, provisional credit rules, or liability caps above, you can sue. The EFTA provides for:

Actual damages, meaning whatever financial harm you suffered.
Statutory damages between $100 and $1,000 per violation in an individual case, whether or not you can prove actual harm.
Attorney’s fees and costs if you win.⁶

The fee-shifting provision matters because it makes smaller claims economically viable to pursue. A bank that stonewalls a $300 dispute faces exposure well beyond $300 if the case goes to court. You also cannot sign these rights away: the EFTA’s anti-waiver provision voids any contract term that would strip your statutory protections. A bank can offer more than the law requires; it cannot offer less.⁷

Stopping Recurring Payments

Regulation E also lets you stop any preauthorized recurring electronic payment. You have to notify your bank at least three business days before the next scheduled transfer, and the notice can be spoken or written.⁸

If you call, the bank can require written confirmation within 14 days. Skip that follow-up and your oral stop-payment order expires, so next month’s charge could go through with no recourse. If a recurring payment slips through after a valid stop-payment order, that transfer is unauthorized and can be disputed through the same error-resolution process.⁸

P2P Apps Are Covered, With One Gap

Person-to-person services like Zelle, Venmo, and Cash App fall under Regulation E when they move funds electronically to or from a consumer account. The same liability caps, investigation timelines, and error-resolution requirements apply. Providers and banks cannot hide behind network rules calling transfers “final and irrevocable” to duck their obligations, and they cannot require you to contact the recipient before investigating.⁴

The gap is the same one that shows up with any scam: if you authorized the transfer yourself, even under false pretenses, the claim is much weaker because the transfer wasn’t initiated by someone other than you. Recovering money you sent voluntarily to a scammer is far harder than recovering money a thief took directly from your account.

1
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
2
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
3
Consumer Financial Protection Bureau. Procedures for Resolving Errors (Regulation E)
4
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
5
Consumer Financial Protection Bureau. Submit a Complaint
6
Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability
7
Office of the Law Revision Counsel. 15 USC 1693l – Waiver of Rights
8
eCFR. 12 CFR 1005.10 – Preauthorized Transfers