Regulation E vs. FCBA: Liability Caps and Dispute Timelines

Federal law gives you much stronger fraud protection on a credit card than on a debit card, and the gap is the single most important thing to understand when comparing debit card vs credit card fraud protection. A credit card holder’s maximum liability for unauthorized charges is $50 in any circumstance. A debit card holder who waits too long to report can lose every dollar in the account. Two different statutes create this gap: the Truth in Lending Act and its Fair Credit Billing Act amendments (implemented through Regulation Z) cover credit cards, and the Electronic Fund Transfer Act (implemented through Regulation E) covers debit cards.¹²

The reason the two frameworks feel so different is that they protect different money. Credit card rules protect borrowed funds you have not yet paid, so a fraud fight is a fight over what you owe. Debit card rules protect cash already sitting in your checking or savings account, so a fraud fight is a fight to get your own money back.

Credit Card Liability Is Capped at $50, Period

Under 15 U.S.C. § 1643, a credit card holder can never owe more than $50 for unauthorized charges.¹ That cap holds whether a thief uses your physical card, steals your number online, or runs up thousands in charges before you notice. There is no tiered system, no penalty for delayed reporting, and no circumstance in which the full bill falls on you. The only preconditions are that the card is one you accepted (not an unsolicited card you never activated) and the issuer gave you a way to report unauthorized use. Any charges made after you report the loss are entirely the issuer’s problem.

Debit Card Liability Climbs with Every Day You Wait

Regulation E works on a sliding scale, and the numbers change fast.

Report within two business days of learning about the loss or theft, and your liability is capped at $50, or the total unauthorized transfers before you notified the bank, whichever is less.³
Report after two business days but within 60 days of the statement, and the cap jumps to $500. The bank can hold you responsible for unauthorized transfers that occurred after the two-day window if it can show those transfers would not have happened had you reported sooner.³
Fail to report within 60 days of the statement, and you could lose everything. The bank has no obligation to reimburse unauthorized transfers that occur after the 60-day window if it can show timely notice would have prevented them.⁴

The two-business-day clock starts when you learn of the loss or theft, not when the charge posts. A “business day” is any day the bank is open for substantially all its functions, and the clock does not count the day of discovery.³ If circumstances beyond your control delay reporting (extended travel, hospitalization), the bank must extend the timelines to a reasonable period.⁴

One useful backstop: the bank cannot use your negligence to push liability past these caps. Writing your PIN on the card or leaving it in an unlocked car might be careless, but none of that lets the bank charge you more than Regulation E allows.⁴

What Visa and Mastercard Add on Top

In practice, most cardholders have better protection than the federal minimums because Visa and Mastercard offer voluntary zero-liability policies. Visa’s policy covers lost, stolen, and fraudulently used cards, and the cardholder is not held responsible for unauthorized transactions processed through the Visa network.⁵ Mastercard offers similar coverage for in-store purchases, phone orders, online transactions, mobile payments, and ATM withdrawals, provided you used reasonable care and reported the loss promptly.⁶

Both networks exclude certain commercial cards and anonymous prepaid cards like gift cards. And both policies are voluntary commitments by the network, not federal law. The networks could change them, and disputes about how the policy was applied do not carry the same enforcement mechanisms as statutory protections. For most everyday consumers this means the practical liability on a major-issuer card is $0 rather than $50. The federal caps still matter as the backstop if a network or issuer fails to honor its own policy.

Credit Cards Give You Leverage Over Bad Merchants

Credit cards carry one protection that has no debit card equivalent: the right to assert claims and defenses against your card issuer when a merchant sells you defective goods or fails to deliver. Under Regulation Z, if you have tried in good faith to resolve the dispute with the merchant and gotten nowhere, you can withhold payment from the issuer for the disputed amount, including any finance charges on it.⁷

Two limits apply. The purchase must exceed $50, and the transaction must have occurred in your home state or within 100 miles of your current billing address.⁷ Both limits disappear when the merchant has a relationship with the issuer, such as a franchised dealer of the issuer’s products or a sale obtained through a mail solicitation the issuer participated in.

This is the provision that makes credit cards genuinely safer for large purchases. Buy a $2,000 appliance with a debit card and the seller refuses to honor the warranty, and your bank has no obligation to step in. Put the same purchase on a credit card, and the issuer shares the risk. Debit card holders dealing with a bad merchant are essentially limited to small claims court or whatever voluntary dispute process the bank offers.

The Scam Gap: “Authorized” vs. “Unauthorized”

The hardest fraud cases involve scams where the victim technically pressed the button. Someone impersonates your bank, talks you into approving a Zelle transfer, and drains the account. A marketplace seller takes payment and vanishes. Whether the law helps you turns almost entirely on who initiated the transaction.

Regulation E only protects against “unauthorized” transfers, meaning transfers initiated by someone other than you, without your permission.⁴ If you personally sent the money (even under false pretenses) the transfer is technically authorized, and the bank has no federal obligation to reverse it.

There is one important carve-out. The Consumer Financial Protection Bureau has stated that when a scammer tricks you into handing over account credentials, such as a texted confirmation code, login information, or your debit card number, and the scammer then uses those credentials to initiate a transfer, that transfer counts as unauthorized under Regulation E.⁸ Being tricked into sharing access information is not the same as giving someone permission to use your account.

So the line runs like this. If the scammer logs into your account and moves the money, Regulation E’s liability limits apply. If the scammer convinces you to open your banking app and send the money yourself, you are likely on your own under current federal law. Credit card holders have somewhat more room to maneuver on merchant fraud because the claims-and-defenses right gives them leverage when a seller fails to deliver, regardless of who tapped “pay.”

How the Dispute Process Differs

Credit Cards Require Written Notice

A credit card billing error dispute triggers powerful protections, but only if you file it in writing. Your notice must reach the address the issuer designates for billing inquiries (not the payment address) within 60 days after the first statement showing the error was sent to you.⁹ The notice must identify your account, describe the error, and explain why you believe it is wrong. Electronic notice counts only if the creditor has specifically said it accepts disputes that way.¹⁰

This trips up a lot of people. Calling customer service and complaining about a charge is not the same as filing a billing error notice under federal law. If you only call, the issuer is not legally required to follow the investigation procedures or give you the payment-withholding rights described below. Many issuers will investigate a phone complaint anyway through their internal chargeback process, but you lose your statutory leverage if you skip the written step.

Debit Cards Accept Oral Notice

Regulation E is more flexible. You can notify your bank in person, by phone, or in writing, using any method that gives the bank enough information to identify the problem.⁴ You have 60 days from the date the bank sent the statement showing the error. The bank may ask you to follow up with written confirmation within 10 business days, and if it does, it must tell you about that requirement and give you the address. If you fail to send written confirmation after being asked, the bank can stop investigating.¹¹

Investigation Timelines and Provisional Credit

A credit card issuer that receives a valid billing error notice must acknowledge the dispute in writing within 30 days. It then has two full billing cycles, but no more than 90 days, to investigate and either correct the error or explain why the charge stands.⁹ If it decides the charge was correct, it must give you a written explanation and copies of supporting documentation on request.

Debit card investigations move on a faster clock because your money is already gone. The bank has 10 business days to investigate. If it needs more time, it can extend the investigation only if it provisionally credits your account for the full disputed amount (minus up to $50 if the bank reasonably believes an unauthorized transfer occurred) within those 10 business days. It must notify you of the provisional credit amount and date within two business days of posting it, and you get full use of those funds while the investigation continues.¹¹

The length of the extended investigation depends on the transaction type:

Standard electronic transfers (ACH, ATM, bill pay): up to 45 days from when the bank received your error notice.
Point-of-sale debit card purchases, foreign transactions, and new accounts (within 30 days of the first deposit): up to 90 days.¹¹

That 90-day window matters because it covers the most common way people use debit cards: swiping or tapping at a store. For most in-person debit card fraud, the bank could take up to three months to resolve your dispute.

Protection While the Dispute Is Open

During a credit card billing dispute, you do not have to pay the contested portion of your bill, and the issuer cannot try to collect it. The creditor cannot report the disputed amount as delinquent to credit bureaus while the investigation is open, cannot accelerate your debt, and cannot close your account solely because you exercised your dispute rights.¹⁰ If you are on autopay, the issuer must stop deducting the disputed amount as long as you submitted your notice at least three business days before the next scheduled payment. The issuer can still collect undisputed portions of the balance and can reduce your available credit by the disputed amount.

Even after the investigation closes, if the creditor decides the charge was valid, it cannot report you as delinquent until it gives you the same number of days to pay (at least 10) that your credit agreement provides for undisputed charges. If you send a second written notice disputing the finding within that window, the creditor can report the amount as delinquent only if it also reports it as disputed and tells you which parties it notified.¹²

Debit card disputes do not offer equivalent credit-report protections because they do not involve credit. The provisional credit rule under Regulation E serves a similar practical purpose, putting the money back in your account so you can keep paying bills while the bank investigates, but only if the bank actually meets the 10-business-day deadline.

Business Cards Are Mostly Outside These Rules

Both Regulation E and the billing error provisions of the FCBA apply to consumer accounts, meaning accounts established primarily for personal, family, or household purposes. Business checking accounts, corporate debit cards, and most commercial credit cards fall outside these protections.

The one exception is the $50 unauthorized use cap for credit cards. Federal law extends that specific protection to business-purpose credit cards, so a business cardholder generally cannot be held liable for more than $50 in unauthorized charges on a lost or stolen card.¹³ But business cardholders do not get the billing error dispute procedures, the payment-withholding rights, or the claims-and-defenses right against merchants.

Business debit card holders have it worse. Regulation E does not cover business accounts at all. If someone drains a business checking account through unauthorized debit transactions, recovery depends on the bank’s account agreement and the Uniform Commercial Code, not federal consumer protection law. Banks vary widely on business account fraud, and some impose shorter reporting windows or higher liability.

If the Bank or Issuer Denies Your Dispute

When a bank or card issuer denies a dispute you believe was valid, or misses the investigation timelines, the Consumer Financial Protection Bureau accepts complaints and forwards them to the company for response. You can file online or by phone, and the CFPB publishes complaint data in a public database.¹⁴ Most companies respond within 15 days, though some take up to 60. After the response, you have 60 days to give feedback on whether the resolution was adequate.

A CFPB complaint is not a lawsuit and does not guarantee a different outcome, but it creates a documented regulatory record that companies take seriously. A formal complaint often prompts a second look at a denied dispute, especially when the bank missed a procedural deadline or failed to provide the required written explanation.

1
Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
2
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
3
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) – Section 1005.6
4
Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
5
Visa. Zero Liability
6
Mastercard. Mastercard Zero Liability Protection for Unauthorized Transactions
7
Consumer Financial Protection Bureau. Regulation Z – 1026.12 Special Credit Card Provisions
8
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
9
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors
10
Consumer Financial Protection Bureau. Regulation Z – 1026.13 Billing Error Resolution
11
Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
12
Office of the Law Revision Counsel. 15 USC 1666a – Regulation of Credit Reports
13
Office of the Comptroller of the Currency. Does the Truth in Lending Act Apply to Business Credit Cards
14
Consumer Financial Protection Bureau. Submit a Complaint