If your debit card has been used fraudulently, here is what to do: call your bank immediately to freeze the card, then send a written dispute so your legal protections lock in. Speed is everything. Under federal law, reporting unauthorized transactions within two business days caps what you can lose at $50. Wait longer and your liability climbs to $500, and after 60 days from the statement showing the fraud, there is no cap at all.
Debit card fraud hits differently from credit card fraud because the money is already gone from your checking account. You are trying to get it back, not disputing a charge on a lender’s books. That single fact is why every hour matters.
Call the Bank and Freeze the Card
Use the fraud number on the back of the card or on the bank’s website. Tell the representative you have identified unauthorized transactions and need the card blocked right now. Ask them to disable any linked digital wallet access at the same time.
Write down the date and time of the call, the representative’s name, and any reference or case number. Your liability under federal law hinges on when you notified the bank, and this note is your proof. Do not end the call until you have confirmation that the card is frozen or canceled.
If the card was loaded into Apple Pay, Google Pay, or a similar wallet, remove it there too. Apple lets you mark a lost device to disable Apple Pay automatically, and you can remove individual cards through your account settings. Ask your card issuer to confirm the token has been deactivated on their end.
Stop the Recurring Payments Attached to the Old Card
Canceling a debit card does not automatically stop recurring charges. Visa and Mastercard run account-updater services that share your new card number with merchants who had the old one on file, so a gym membership or streaming subscription can keep billing after the compromised card is gone.1Visa. Visa Account Updater for Merchants
Make a list of every service that auto-bills the card and update or cancel each one directly. To kill a recurring payment through your bank, federal rules let you send a stop-payment order at least three business days before the next scheduled transfer. You can call it in, but the bank may require written follow-up within 14 days to keep the stop-payment in effect.2eCFR. 12 CFR 205.10 Preauthorized Transfers
Send a Written Dispute Within 60 Days
The phone call stops the bleeding. A written dispute locks in your legal protections. Regulation E requires the bank to receive your written notice of the unauthorized transactions within 60 calendar days after it sent the statement that first showed the fraudulent charge.3eCFR. 12 CFR Part 205 Electronic Fund Transfers (Regulation E) – Section: 205.11 Procedures for Resolving Errors Miss that window and you can lose the right to dispute those specific transactions.
Include your name and account number, the dates and amounts of the unauthorized charges, and a clear statement that you did not authorize them. Attach copies of the relevant statements. Send everything by certified mail with a return receipt. That receipt is your most important piece of paper if the dispute stretches out.
File a Police Report and an FTC Report
Call your local police department’s non-emergency line and file a report. Banks do not always require one, but it strengthens your claim and shows you treated the theft as a crime. Get the report number and include it in your written dispute.
File a second report at IdentityTheft.gov. An FTC Identity Theft Report carries legal weight: businesses may require a copy when you ask them to close fraudulent accounts or remove unauthorized charges, and it helps when correcting credit report errors.4Federal Trade Commission. Identity Theft Steps The FTC site also produces a personalized recovery plan based on your situation.
What You Could Actually Lose
The Electronic Fund Transfer Act and Regulation E set a tiered liability system built entirely around how quickly you report. The clock runs from when you learn about the fraud, not when it happened.
- Within 2 business days: your maximum liability is $50, or the amount of unauthorized transfers that occurred before you notified the bank, whichever is less.5eCFR. 12 CFR Part 205 Electronic Fund Transfers (Regulation E) – Section: 205.6 Liability of Consumer for Unauthorized Transfers
- After 2 business days but within 60 days of the statement: your liability jumps to $500, and only for losses the bank can show would not have happened had you reported sooner.
- After 60 days from the statement: no cap on unauthorized transfers that occur after that 60-day mark.
One detail buried in the rules works in your favor. The bank bears the burden of proving you authorized a transaction, and if it wants to hold you liable beyond the minimum, it must show the later transfers would not have occurred had you reported sooner. You do not have to prove you did not make the charge.
What the Bank Has to Do Next
Once the bank receives your notice, it has 10 business days to investigate and decide whether an error occurred. It can extend the investigation to 45 calendar days, but only if it provisionally credits the disputed amount to your account within those initial 10 business days.3eCFR. 12 CFR Part 205 Electronic Fund Transfers (Regulation E) – Section: 205.11 Procedures for Resolving Errors That provisional credit gives you access to the money while the case is worked.
The timelines stretch in specific situations. Point-of-sale debit card transactions, transfers that originated outside the United States, and accounts opened within the previous 30 days give the bank 20 business days to provide provisional credit and up to 90 calendar days to complete the investigation.6Consumer Financial Protection Bureau. 12 CFR 1005.11 Procedures for Resolving Errors Most in-store debit card fraud is point-of-sale, so the longer timeline applies more often than people expect.
If the bank confirms the fraud, the provisional credit becomes permanent. If it decides against you, it must send a written explanation and give you at least three business days’ notice before pulling the provisional credit back.
Ask About Zero-Liability Coverage
The federal caps are the legal floor. Most debit cards carry stronger protection through the card network’s own policy. Visa’s Zero Liability Policy covers debit and credit cards and states you will not be held responsible for unauthorized charges, whether they happen online or in person; Visa requires issuing banks to replace stolen funds within five business days of notification.7Visa. Visa Zero Liability Policy Mastercard offers a similar guarantee for purchases in stores, online, over the phone, through a mobile device, and at ATMs.8Mastercard. Mastercard Zero Liability Protection Policy
Both policies require reasonable care in protecting the card and prompt reporting. Neither covers commercial cards or anonymous prepaid cards like gift cards. If your bank cites the $50 or $500 EFTA limits when resolving your claim, push back and ask about the network’s zero-liability policy. It often produces a better result.
If the Bank Denies Your Claim
A denial is not the end. Request the bank’s written explanation, which it is legally required to provide, and read it carefully to see whether the bank actually investigated or rubber-stamped a rejection.
File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov. The CFPB forwards your complaint to the bank, which generally must respond within 15 days. That alone often produces results a customer-service call could not.
Federal law also gives you real leverage. If a bank fails to provisionally credit your account within the required 10 business days and either did not investigate in good faith or had no reasonable basis for concluding you authorized the transaction, a court can award treble damages, three times the amount of your proven loss. Beyond that, the EFTA allows you to recover actual damages, statutory damages between $100 and $1,000, and attorney’s fees.9Office of the Law Revision Counsel. 15 USC 1693m Civil Liability Banks know these penalties exist, which is why a well-documented dispute rarely reaches court.
Fraud Through Venmo, Cash App, and Zelle
If someone got into your Venmo, Cash App, Zelle, or a similar service and moved money from your linked debit card without permission, Regulation E still applies. These peer-to-peer transfers are electronic fund transfers, so the same liability tiers and investigation timelines govern your claim.10eCFR. 12 CFR Part 205 Electronic Fund Transfers (Regulation E) Report the fraud to the payment app and to the bank that issued your debit card. The bank has the legal obligation to investigate; the app notification creates an added paper trail and may lead to a freeze on the fraudster’s side.
One catch. If you voluntarily sent money to someone who turned out to be a scammer, that is harder to recover. Regulation E covers unauthorized transfers, meaning someone else initiated the transaction without your permission. A transfer you personally authorized, even under false pretenses, may not qualify. Document everything and file the claim, but temper expectations for that scenario.
Business Debit Cards Sit Outside These Rules
If the compromised card was a business debit card, the EFTA’s liability caps and investigation timelines probably do not apply. The statute defines “consumer” as a natural person, and Regulation E was built for individual consumer accounts.11GovInfo. 15 USC 1693a Definitions Business checking accounts fall outside that scope. Your recovery rights depend on your account agreement and any commercial card protections offered by the network. Some banks voluntarily extend consumer-like protections to small business accounts; others offer almost none.
Protect Against a Wider Compromise
Debit card fraud can be a sign that more of your personal information is out there. A few steps beyond the card replacement prevent a second wave.
Freeze Your Credit
A fraud alert tells lenders to verify your identity before opening new credit in your name. You only contact one of the three major credit bureaus (Equifax, Experian, or TransUnion), and that bureau is required to notify the other two. An initial fraud alert lasts one year and entitles you to a free copy of your credit report from each bureau.12Office of the Law Revision Counsel. 15 USC 1681c-1 Identity Theft Prevention Fraud Alerts and Active Duty Alerts
A security freeze goes further. It blocks access to your credit report entirely, so no one can open new accounts in your name until you lift it. Federal law requires all three bureaus to place and remove freezes free of charge. You have to contact each bureau separately, and the freeze stays in place until you remove it. For most people dealing with debit card fraud, a freeze is the stronger move; an alert only asks lenders to try harder to verify identity, while a freeze stops the inquiry cold.
Change Your PIN and Passwords
Pick a new PIN with no connection to birthdates, addresses, or anything a thief may already have. Change the passwords on your online banking portal and on the email account linked to your bank; fraudsters routinely use email access to intercept alerts or reset passwords on other accounts. Turn on two-factor authentication if your bank offers it. A second verification step through a separate device makes it dramatically harder for someone with just your password to get in.
Turn On Transaction Alerts
Most banks let you set up real-time text or push notifications for every debit card transaction. This is the best early-warning system there is. If a charge posts that you did not make, you know within seconds instead of discovering it on next month’s statement. Given that federal liability turns on how fast you report, instant notifications can be the difference between a $0 loss and a $500 one. In your bank’s app settings, enable alerts for all transactions, not just those above a dollar threshold.