Debit card fraud protection comes primarily from the federal Electronic Fund Transfer Act and its Regulation E, which cap your liability for unauthorized charges based on how quickly you report the problem to your bank. Catch it fast and you may owe nothing. Wait too long and your losses can be unlimited. Your bank is also required to investigate disputed charges on a set timeline and, in most cases, give you temporary access to the disputed money while it looks into the claim.
How Much You Can Lose Based on When You Report
When your physical debit card or PIN is lost or stolen, federal law sets three liability tiers tied to how fast you tell your bank:1GovInfo. 15 USC 1693g – Consumer Liability
- Report within 2 business days of learning the card is lost or stolen, and your liability is capped at $50 (or the amount of unauthorized transfers, whichever is less).
- Report after 2 business days but within 60 days of the statement being sent, and your liability can reach $500 for transfers that happened after the two-day window.
- Report more than 60 days after the statement is sent, and you lose federal protection for any unauthorized transfers that occur after that 60-day deadline. There is no cap.
The two-day clock starts the moment you learn the card or PIN is missing, not when a fraudulent charge appears.2Consumer Financial Protection Bureau. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers If you notice your wallet is gone on a Sunday evening, Tuesday is already day two.
When Only Your Card Number Is Stolen
A different rule applies when the physical card never leaves your possession but the number is compromised through a data breach, online skimming, or similar digital theft. In that situation you have no liability for unauthorized transfers as long as you report them within 60 days of the statement that first shows the fraudulent charge.2Consumer Financial Protection Bureau. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers
After that 60-day window closes, you become responsible for anything that happens going forward. Because stolen card numbers often go unnoticed longer than a missing wallet, reviewing your statements promptly is what keeps you inside the protected window.
What Counts as an Unauthorized Charge
Regulation E defines an unauthorized electronic fund transfer as one initiated by someone other than you, without your permission, and from which you received no benefit.3Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs That covers a thief using your stolen card, a hacker making online purchases with your number, and forced ATM withdrawals.
It also covers one scenario people often assume is their own fault. If a scammer tricks you into sharing your login credentials or a confirmation code and then uses that information to move money out of your account, the CFPB treats the resulting transfer as unauthorized. Being deceived into handing over account information is not the same as voluntarily giving someone access.3Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
Two situations fall outside the protection. If you let a family member, roommate, or anyone else use your card or account, their transactions are not unauthorized unless you have already told your bank to revoke that person’s access. And transfers you make with your own fraudulent intent are never covered.
If You Could Not Report on Time
Federal law requires your bank to extend both the two-day and 60-day deadlines by a reasonable period when extenuating circumstances kept you from reporting. The statute specifically names extended travel and hospitalization as qualifying examples.1GovInfo. 15 USC 1693g – Consumer Liability If the bank refuses to honor a legitimate reason, you can escalate through the dispute paths below.
Zero Liability Policies From Visa and Mastercard
The two largest card networks layer their own protections on top of federal minimums. Visa’s Zero Liability Policy says you are not responsible for unauthorized charges on a Visa debit or credit card, whether the fraud happens online or offline. It does not apply to commercial cards, anonymous prepaid cards like gift cards, or transactions that are not processed through the Visa network.4Visa. Zero Liability Policy
Mastercard’s Zero Liability Protection works similarly, provided you used reasonable care in protecting the card and promptly reported the loss or theft. Mastercard also excludes commercial cards and unregistered prepaid cards.5Mastercard. Zero Liability Protection Policy
These are voluntary network policies, not federal law. Some PIN-based transactions processed outside the card network may fall outside coverage. If a network claim is denied, Regulation E still backs you up.
How to Report Fraud to Your Bank
Call your bank as soon as you spot an unauthorized charge. You can also report through a mobile banking app, in person, or by mailing a written dispute to the address on your statement.2Consumer Financial Protection Bureau. 12 CFR 1005.6 Liability of Consumer for Unauthorized Transfers Your notice is effective as long as you give the bank enough information to identify your account, even if you cannot immediately supply the full card number.
When you file, include your name and account number, the transactions you believe are unauthorized, the date and dollar amount of each, and why you believe an error occurred. If the card was lost or stolen, note the date you discovered it missing.6eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
Watch out for one trap. If you report by phone, the bank may require written confirmation within 10 business days. Miss that deadline and the bank is not required to give you provisional credit during an extended investigation.7Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution For a sizable claim, send the written follow-up by certified mail so you have a receipt.
What the Bank Must Do After You Report
Once you notify the bank, it has 10 business days to investigate and tell you what it found.7Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution If it confirms an error, it must correct the problem within one business day of that determination.
If the bank needs more time, it can extend the investigation to 45 days (90 days for point-of-sale debit transactions, foreign transactions, and transfers on accounts opened less than 30 days earlier). To take the extension, the bank must provisionally credit your account within the original 10-business-day window, though it may withhold up to $50 if it has a reasonable basis to suspect an unauthorized transfer.8eCFR. 12 CFR 205.11 – Procedures for Resolving Errors
When the investigation ends, the bank has three business days to tell you its decision.9eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors A finding of fraud makes the provisional credit permanent. A denial requires a written explanation, removal of the provisional credit, and notice of your right to request copies of the documents the bank relied on.
Why Timing Matters More With Debit Than Credit
Credit card fraud liability is capped at $50 regardless of how fast you report, under the Truth in Lending Act, and most issuers waive even that.10GovInfo. 15 USC 1643 – Liability of Holder of Credit Card Debit card losses hit differently because the money is already gone from your checking account. Even when the bank issues a provisional credit, you can wait up to 10 business days to get temporary access, and during that window you may face bounced checks, missed automatic payments, and overdraft fees from the shortfall.
If the Bank Denies Your Claim
First, ask for the documents the bank used to deny the claim. You have a legal right to see them. Review the records for errors or evidence the bank overlooked.
If you still believe the denial was wrong, file a complaint with the Consumer Financial Protection Bureau online or by phone at (855) 411-2372. The CFPB forwards complaints to the bank, which generally responds within 15 days.11Consumer Financial Protection Bureau. Submit a Complaint About a Financial Product or Service Attach key dates, amounts, and copies of your communications with the bank (up to 50 pages of supporting documents).
You can also sue. The Electronic Fund Transfer Act makes a bank that violates the law liable for your actual damages plus statutory damages between $100 and $1,000 per individual action, and the court can award attorney fees and costs if you win.12Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability You have one year from the violation to file. For smaller amounts, small claims court is a simpler option, with filing fees that generally run from about $15 to $300 depending on the jurisdiction.