Under federal law, a credit card gives you stronger fraud protection than a debit card: the gap between debit card and credit card fraud protection comes down to whose money the thief is spending and how fast you can get it back. A stolen credit card number costs you $50 at most, and the disputed charge sits on the bank’s credit line while things get sorted out. A drained debit card can cost you $50, $500, or every dollar the thief took, and the money is gone from your checking account until the bank decides to return it.
How Much You Can Owe After Fraud
Credit card liability is capped at $50 by statute. Under 15 U.S.C. § 1643, a cardholder’s exposure for unauthorized charges cannot exceed $50, and even that cap applies only if the issuer gave you a way to report loss or theft, warned you about potential liability, and provided a method to identify the authorized user.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card2Visa. Visa’s Zero Liability Policy3Mastercard. Zero Liability Protection
Debit cards work on a sliding scale that punishes slow reporting. The Electronic Fund Transfer Act, at 15 U.S.C. § 1693g, sets three tiers tied to how quickly you tell the bank:
- Report within two business days of learning your card was lost or stolen, and your liability tops out at $50.
- Report after two business days but within 60 days of the statement being sent, and your liability can reach $500 for transfers that happened after the two-day window closed.
- Report after the 60-day window, and the bank has no obligation to refund anything that happened after it closed. Liability is effectively unlimited.
The two-day clock runs from when you learn the card is missing. The 60-day clock runs from when the bank mails or transmits your statement.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
One important carve-out: if your physical card was never lost or stolen but someone obtained the number through a data breach or skimming device, and you report the fraudulent charges within 60 days of your statement, your liability is $0. The tiered penalties kick in specifically when the card or access device was lost or stolen and you delayed reporting.
Whose Money Is Missing While the Bank Investigates
This is where the gap hits hardest in daily life. Credit card fraud is a line item on a statement. Your checking balance never moves. The issuer suspends the charge during the investigation, and you keep paying your bills from your own money. Even a drawn-out dispute leaves your cash flow intact.
Debit card fraud takes the money first and asks questions later. Under 15 U.S.C. § 1693f, the bank has 10 business days to investigate your claim. It can extend that to 45 days, but only if it provisionally credits your account within the first 10 business days and notifies you within two business days of issuing that credit.5Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution6Consumer Financial Protection Bureau. Regulation E Section 1005.11 – Procedures for Resolving Errors
Ten business days is two full calendar weeks. If the fraud wiped out a meaningful chunk of your balance, your mortgage can go unpaid, an auto-draft can bounce, and groceries can overdraft before the provisional credit lands. The disputed credit card charge was never your money to begin with, so none of this happens with a credit card.
Overdraft Fees and Credit Score Fallout
Debit card fraud often triggers a cascade of fees beyond the stolen amount. If unauthorized charges push your account negative, your bank can charge overdraft or non-sufficient-funds fees on every transaction that bounces afterward. Regulation E requires the bank to refund those fees once it confirms the fraud, as part of correcting the error.7eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) But refunds come after the investigation ends, not during. For 10 to 45 days, your balance can stay negative, automatic payments can fail, and third parties like landlords or utility companies can hit you with late fees the bank is not required to cover.
Credit cards also carry a specific protection for your credit score. Under the Fair Credit Billing Act, a creditor cannot report a disputed amount as delinquent to credit bureaus while the dispute is under investigation, unless it reports the amount as disputed and notifies you of who received the report.8GovInfo. 15 USC 1666c – Right of Borrower to Assert Claims and Defenses Debit card fraud does not touch your credit directly, since a checking account is not a credit account, but a drained balance can hurt your credit indirectly if it causes you to miss payments on other bills.
Disputing a Merchant Who Shortchanged You
Fraud is not only stolen numbers. Sometimes you pay a legitimate merchant and the product never arrives, arrives broken, or doesn’t match what you agreed to. Credit and debit cards treat these disputes very differently.
Credit cardholders can dispute billing errors under 15 U.S.C. § 1666 by sending written notice to the card issuer within 60 days of the statement showing the charge. During the investigation, the issuer cannot try to collect the disputed amount or report it as delinquent.9Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Beyond billing errors, you can assert any legal claim you would have against the merchant directly against the card issuer, as long as the original purchase exceeded $50 and happened in your home state or within 100 miles of your mailing address. Those geographic and dollar limits don’t apply if the merchant is affiliated with the issuer or if the purchase came from a mail solicitation by the issuer.10Office of the Law Revision Counsel. 15 USC 1666i – Assertion by Cardholder Against Card Issuer of Claims and Defenses For online purchases, many issuers interpret the 100-mile rule loosely or ignore it as a matter of policy, though the statutory text has not changed.
Debit card users have no comparable federal right to reverse merchant charges. Your bank may offer a voluntary dispute process, and the card network’s chargeback system may help in some cases, but neither carries the force of a statute that requires the bank to withhold payment or investigate on your timeline. If the merchant refuses to cooperate, a debit card user’s recourse is essentially state consumer-protection law or small claims court. For large or uncertain purchases, that gap alone argues for a credit card.
When You Authorized the Payment Yourself
Every protection above applies to unauthorized transactions, meaning someone else moved the money without your permission. A growing category of fraud flips that: the consumer sends the money voluntarily after being deceived. Impersonation scams, fake invoice schemes, romance fraud, and most losses on peer-to-peer apps like Zelle or Venmo work this way.
The Electronic Fund Transfer Act defines an unauthorized transfer as one “initiated by a person other than the consumer without actual authority” where the consumer received no benefit. If you personally tapped send, even under false pretenses, the transfer was authorized in the eyes of the statute, and the liability protections do not apply.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability The same logic covers credit cards: if you willingly gave your number to a scammer posing as a vendor, the charge was authorized even though you were deceived about what you were buying.
Some banks and payment networks have begun offering voluntary reimbursement in certain scam scenarios, but no federal law requires it. Treat any payment you initiate yourself, by card, app, or wire, as essentially irreversible once it clears.
Prepaid and Business Cards Play by Different Rules
A registered prepaid card, where you have verified your identity with the issuer, gets the same Regulation E protections as a standard debit card: liability caps, error resolution, provisional credits. An unregistered prepaid card, like a gift card or a reloadable card bought at a convenience store, gets almost none of them. If the issuer has not verified who you are, it has no obligation to limit your liability or investigate errors on the standard timeline, and even if you register later, the issuer does not have to resolve disputes for transactions that happened before verification.11Federal Register. Rules Concerning Prepaid Accounts Under the Electronic Fund Transfer Act (Regulation E) and the Truth in Lending Act (Regulation Z) Both Visa and Mastercard also exclude anonymous prepaid cards from their zero-liability policies.
Business debit cards sit even further outside the safety net. The Electronic Fund Transfer Act and Regulation E cover accounts established primarily for personal, family, or household purposes, which excludes business checking accounts entirely.12Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs Business credit cards fare better: the $50 liability cap under Regulation Z applies to credit cards issued to any person or organization, including businesses. If an issuer provides 10 or more cards to one organization’s employees, the issuer and the organization can negotiate a different arrangement that ignores the $50 cap, though individual employees keep the $50 protection unless they separately agreed otherwise.13Consumer Financial Protection Bureau. Regulation Z Section 1026.12 – Special Credit Card Provisions
What to Do the Moment You Spot Fraud
Speed matters more than anything else, especially with a debit card. The CFPB advises notifying your bank or credit union as soon as you discover an unauthorized transaction, and once you report it the bank generally has 10 business days to investigate.14Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account
For a debit card, the deadlines depend on the situation:
- If the card itself is lost or stolen, notify the bank within two business days of discovering the loss. That keeps your liability at or below $50.
- If the card never left your possession but charges appear anyway, report within 60 days of the statement showing them. Your liability is $0 as long as you meet that deadline.
- If a PIN or security code was stolen, report within two business days, same as a lost card.
For a credit card, send written notice to the issuer’s billing-inquiry address within 60 days of the statement date, including your name, account number, the charge you believe is wrong, and why. The issuer must acknowledge the dispute within 30 days and resolve it within two billing cycles, never more than 90 days.9Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Most issuers also accept disputes by phone or app, but a written notice gives you the clearest legal footing.
Whichever card was compromised, ask for a new card number right away, review recent statements line by line, and check your credit reports for accounts or inquiries you don’t recognize. If the fraud reached beyond the card number into your personal information, consider a fraud alert or credit freeze with the three major credit bureaus.