Regulation E Reporting Deadlines: The 60-Day Window and Card Loss Caps

Under Regulation E, you have 60 calendar days to report an unauthorized electronic transfer to your bank, and that clock starts on the date the bank sends the periodic statement showing the transfer, not the day you read it. Miss the 60-day reporting deadline and you lose federal protection for every unauthorized transfer that happens after the window closes. Shorter deadlines apply when a debit card itself is lost or stolen, and those are covered below.

How the 60-Day Clock Is Counted

The clock starts on the transmittal date of the statement that first shows the unauthorized transfer. For paper statements, that’s the mailing date. For electronic statements, it’s the date the bank sends the notification that your statement is available.¹ Whether you actually opened the envelope or logged in doesn’t matter. That’s what catches people who let mail accumulate or ignore banking notifications.

You count 60 calendar days, not business days. Weekends and holidays are included. If a fraudulent charge first appears on a statement sent January 15, your deadline is March 16.

Regulation E allows the deadline to be extended when the delay results from extenuating circumstances. The regulation’s commentary names extended travel and hospitalization as examples.¹ If you can show that a medical emergency or a similar situation kept you from reviewing your statements, the bank must extend the deadline to a reasonable period. What counts as reasonable isn’t defined, so you’d be negotiating with the bank or arguing it in court.

One point worth noticing: the 60 days runs from the statement, not from the transfer itself. A charge that posts in the middle of a statement cycle gives you the rest of that cycle plus 60 more days after the statement is sent. A charge that hits the day before the cycle closes gives you effectively only 60 days.

What Happens if You Miss the 60 Days

This is where consumers get seriously hurt. If you fail to report an unauthorized transfer within 60 days of the statement that first showed it, you lose federal protection for every unauthorized transfer that occurs after that 60-day window closes and before you finally notify the bank.¹ There is no dollar cap. A thief who keeps draining the account for months after the deadline can take everything, and the bank has no federal obligation to make you whole for the post-deadline losses.

Transfers that appeared on the original statement are treated differently from later ones. The severe uncapped liability attaches to the transfers that happen after the 60-day window ends. That is the loss the reporting deadline is designed to prevent.

The bank still bears the burden of proving that those post-deadline transfers would not have occurred if you had reported on time.² If a thief would have found another route into your account regardless, the bank can’t push that loss onto you. But proving a negative is hard to challenge from the consumer side, so the practical risk of missing the deadline remains severe.

Shorter Deadlines for a Lost or Stolen Card

When the problem is a lost or stolen debit card (as opposed to unauthorized transfers you spot on a statement), a faster clock kicks in on top of the 60-day rule.

Within Two Business Days: $50 Cap

Report a lost or stolen debit card within two business days of discovering it’s missing and your liability is capped at the lesser of $50 or the total unauthorized transfers that happened before you gave notice.¹ If a thief charged $30 before you called, you owe at most $30.

Many consumers pay nothing at all in practice. Visa and Mastercard both operate voluntary zero-liability policies that waive the $50 for unauthorized transactions on their networks when the cardholder has been reasonably careful.³ Those network policies go beyond federal law but are contractual and can be denied based on account history or delayed reporting.

After Two Business Days but Within 60 Days: $500 Cap

Report after two business days but before the 60-day statement window closes, and your exposure climbs to as much as $500. The calculation is layered: you’re on the hook for up to $50 for transfers in the first two days, plus the full amount of any transfers between day three and the day you contact the bank, with the combined total capped at $500.¹ The bank has to prove that those later transfers would not have happened if you had reported sooner.

After 60 Days: No Cap

Once 60 days have passed since the statement was sent, the uncapped liability described above applies to post-deadline transfers, whether or not the card itself was lost or stolen.

How To Give Notice So the Deadline Actually Stops

Your notice needs enough information for the bank to identify the problem: your name, your account number, an explanation of why you believe an error occurred, and (to the extent you know) the type, date, and amount of the disputed transaction.⁴ You don’t need a police report or documentary evidence at this stage. A clear phone call to your bank’s customer service line is enough to trigger the process and stop the clock.

The bank can require written confirmation within 10 business days of your oral report, and it must tell you about that requirement and where to send it when you call.⁴ Don’t ignore that follow-up request. Failing to send the written confirmation when asked can affect how the investigation proceeds.

One thing the bank cannot do: require you to contact the merchant before it begins its own investigation. The CFPB has cited institutions for telling consumers to work it out with the merchant first instead of promptly launching an inquiry.⁵ If a bank tries to deflect that way, push back and reference the regulation.

A common misconception is that the consumer has to prove the transfer was unauthorized. Under Regulation E, the burden runs the other way. To hold you liable for transfers that occurred after the two-business-day window or after the 60-day statement window, the bank must establish that those transfers would not have occurred if you had reported sooner.² You still need to report with enough detail for an investigation, but the legal presumption sits with you.

What Happens After You Report

Filing on time stops the liability clock. It also starts a set of deadlines that run against the bank.

The bank generally has 10 business days from receiving your notice to finish its investigation and decide whether an error occurred. For accounts that received their first deposit within the past 30 days, the bank gets 20 business days.⁴

If the bank can’t finish within that initial 10-day period, it can extend the investigation to 45 days, but only if it provisionally credits your account for the full disputed amount, plus any interest, within those first 10 business days.⁴ That provisional credit gives you use of the money while the review continues.

The 45 days stretches to 90 days in three situations: transfers not initiated inside the United States, point-of-sale debit card transactions, and transfers that occurred within the first 30 days after account opening.⁴ International and POS disputes take longer because they involve more parties.

When the bank confirms an error, it must correct it within one business day and refund any fees that resulted from the error, such as overdraft charges triggered by the fraudulent transaction.⁶ The bank must report its conclusion to you within three business days of finishing the investigation.⁴

If the bank concludes no error occurred, it must send a written explanation and give notice before reversing any provisional credit. It has to tell you the date and amount of the debit, and honor any checks, bill payments, or preauthorized transfers from your account for five business days after sending the notice, without charging overdraft fees on those items.⁶ You’re entitled to request copies of the documents the bank relied on and to escalate through a CFPB complaint or a lawsuit under the EFTA if you believe the conclusion was wrong.

When the 60-Day Deadline Does Not Apply

The 60-day rule is a consumer protection rule for consumer accounts, and a few common situations sit outside it.

Business accounts are not covered by Regulation E. The regulation defines “account” as one established primarily for personal, family, or household purposes.⁵ Fraud on a company’s operating account is governed by UCC Article 4A and whatever security procedures the commercial account agreement lays out, not by Regulation E’s deadlines or liability caps.

Credit cards are governed by a different law, Regulation Z. Unauthorized credit card charges are capped at $50 in liability with no tiered deadline system, and most issuers voluntarily waive even that $50. If you’re reading this because of a credit card charge, the 60-day rule doesn’t apply to you.

International remittance transfers have their own deadline. Errors on remittances covered by Subpart B must be reported within 180 days of the disclosed date the funds were supposed to be available to the recipient, not 60.⁷

Peer-to-peer app transfers from a consumer bank account are covered by Regulation E, and the 60-day deadline applies. The CFPB has said the same liability protections and error resolution timelines apply regardless of what a P2P provider’s terms of service claim.⁵ The harder question is whether a P2P transfer was “unauthorized.” If someone stole your credentials or tricked you into handing over a confirmation code by impersonating your bank and then moved the money, the CFPB treats that as an unauthorized transfer covered by Regulation E. If you voluntarily sent money to someone who turned out to be dishonest, the bank is likely to treat the transfer as authorized, and Regulation E’s protections generally will not apply.

1
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
2
Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Liability of Consumer for Unauthorized Transfers
3
Visa. Visa Zero Liability Policy
4
eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
5
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
6
Consumer Financial Protection Bureau. 12 CFR Part 1005 (Regulation E) – Procedures for Resolving Errors
7
eCFR. 12 CFR 1005.33 – Procedures for Resolving Errors