Lost or Stolen Debit Card: EFTA Liability Tiers and Deadlines

If your debit card is lost or stolen, federal law caps what you can lose at $50 — but only if you call your bank within two business days of realizing the card is gone. Wait longer and your liability for a lost or stolen debit card climbs to $500, and if you let 60 days pass from the date your bank sends the statement showing unauthorized charges, there is no cap at all. The clock that matters is the one that starts the moment you notice the card is missing, so the first thing to do is stop reading and call.

The Three Liability Tiers

Regulation E, the Consumer Financial Protection Bureau rule that enforces the Electronic Fund Transfer Act, sets a tiered liability system based on how quickly you notify your bank after discovering the loss.

Report within two business days of learning the card is gone: your maximum liability is $50, or the total unauthorized charges before you called, whichever is less. If a thief ran up $2,000 before you noticed, you still owe no more than $50. If they only managed $30, you owe $30.¹
Report after two business days but within 60 days of the statement showing the first unauthorized charge: your cap rises to $500. The bank can hold you responsible for charges that happened after the two-day window closed, up to $500, if it can show those later charges would not have occurred had you called sooner.¹
Fail to report within 60 days of the statement being sent: no cap. You could lose everything in the account, plus funds in linked accounts, for any unauthorized transfers the bank shows would have been prevented by timely notice.¹

These protections apply to accounts used primarily for personal or household purposes. The law also recognizes a separate situation where only your card number is stolen but you still have the physical card — in that case, the two-day clock does not apply, and you have 60 days from the statement date to report without any liability for the fraudulent charges.¹

How Fast Is Two Business Days, Really?

A “business day” under Regulation E means any day the bank is open to the public for substantially all of its banking functions.² Weekends and bank holidays do not count. A card you discover missing on Friday evening keeps you in the $50 tier through the close of business on Tuesday. A card lost the night before Thanksgiving gives you a longer runway than you might think, but also more days for a thief to work.

The clock runs from when you learn the card is gone, not from when it was actually lost. If the card fell out of your wallet last Saturday but you did not notice until this morning, the two-day count starts today.

How to Report the Loss

You can notify your bank in person, by phone, or in writing. The notice counts even if you use an address or phone number different from the one the bank officially specifies, and you do not need to have your account number or card number ready for the notice to be legally effective. Identifying the account by your name and type is enough.³

In practice, do two things in this order:

Lock the card inside your bank’s mobile app. This blocks new transactions immediately and buys you a few minutes while you make the call.
Call the bank’s fraud line and formally report the loss. That phone call is what starts the legal clock on your liability protections. Ask for a confirmation number and write down the date, time, and name of the representative.

Before you call, pull together your account number, the date and time you realized the card was missing, and a quick list of recent charges you recognize so the fraud team can isolate where your legitimate activity ends. Someone else can report on your behalf if you cannot, though the bank may ask for documentation showing that person is authorized to act for you.³

The Written Confirmation Trap

After you report by phone, your bank is allowed to require written confirmation of the error within 10 business days.⁴ If it requires this and you do not send it in time, the bank is no longer obligated to provisionally credit your account while it investigates.⁵ Your money stays gone during what can stretch to 45 or 90 days.

On the fraud call, ask directly whether written confirmation is required and where to send it. If it is, send the letter by certified mail with return receipt the same day or the next, so you have proof of timely delivery.

If You Genuinely Could Not Call in Time

The law extends the reporting deadlines to “a reasonable time under the circumstances” if something truly prevented you from notifying the bank, such as hospitalization or extended travel abroad.⁶ This is not automatic. You will need to explain the situation and expect to produce documentation like hospital records or travel itineraries. A bank that refuses to consider legitimate extenuating circumstances is violating federal law.

What the Bank Must Do After You Report

Once your bank receives the error notice, it has 10 business days to investigate and decide whether an error occurred.⁷ If it needs longer, it can take up to 45 days, but only if it provisionally credits your account for the full disputed amount within those first 10 business days and notifies you of the credit within two business days of making it. You get full use of the credited funds during the investigation.

The investigation can run 90 days instead of 45 if the transfer was international, resulted from a point-of-sale debit card transaction, or occurred within 30 days of the first deposit to a new account.⁷ For new accounts, the provisional credit deadline also stretches to 20 business days.⁴

If the investigation confirms the fraud, the bank must correct the error within one business day and refund any fees it imposed because of the unauthorized charges, such as overdraft or nonsufficient-funds fees caused by the fraudulent transaction.⁴

If the bank decides no error occurred, it must give you a written explanation and tell you that you can request copies of the documents it relied on.⁴ If it issued provisional credit, it can reverse that credit after sending the notice. Request those documents, review them, and escalate if the reasoning is wrong.

If the Bank Will Not Follow the Rules

Banks that ignore Regulation E deadlines, skip provisional credit, or deny claims without the required written explanation are breaking federal law, and you have two levels of recourse.

File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by calling (855) 411-2372. The CFPB forwards the complaint to the bank and generally requires a response within 15 days.⁸

You also have a private right of action under the EFTA. In an individual suit you can recover your actual damages plus statutory damages between $100 and $1,000, together with attorney’s fees and court costs.⁹ One point worth knowing before you argue with your bank: if there is any dispute over whether a transfer was authorized, the burden of proof is on the bank, not on you.⁶ That shifts the conversation.

1
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
2
eCFR. 12 CFR 1005.2 – Definitions
3
Consumer Financial Protection Bureau. Comment for 1005.6 – Liability of Consumer for Unauthorized Transfers
4
Consumer Financial Protection Bureau. 12 CFR Part 1005 Regulation E – Procedures for Resolving Errors
5
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
6
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
7
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
8
Consumer Financial Protection Bureau. Submit a Complaint
9
Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability