Under the 60-day periodic statement rule in Regulation E, you have 60 days from the date your bank sends the statement showing an unauthorized electronic transfer to report it. Miss that window and federal law stops capping your losses: you can be held liable, with no dollar limit, for every unauthorized transfer that occurs between the deadline and the day you finally notify the bank.1Consumer Financial Protection Bureau. 12 CFR Part 1005 – Liability of Consumer for Unauthorized Transfers That exposure is the single biggest reason to review your checking and savings statements promptly.
When the 60-Day Clock Starts
The countdown begins on the date your financial institution transmits the periodic statement, not the date you open or read it.2eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) – Section 205.6(b)(3) For paper statements, that generally means the mailing date. For electronic statements, it means the date the statement is made available through the bank’s portal. A paper statement that sat in your mailbox for a week, or an online statement you never logged in to see, does not buy you extra time.
The clock is tied to the first statement on which the unauthorized transfer appears. A duplicate or corrected statement that shows the same charge later does not restart the period. Banks keep precise records of when each statement is generated and sent, so arguments about the start date rarely go the consumer’s way.
If fraud hits your account across several statement cycles, each transfer carries its own 60-day deadline running from the statement where that particular transfer first appeared. Fraud spanning January through April creates four separate deadlines, not one. Missing the January deadline does not automatically forfeit your rights to dispute the February, March, and April charges, but it does expose you to liability for anything that happens after that first missed window.
What You Owe If You Miss the Deadline
Once the 60-day window closes on a given statement, you become liable for every unauthorized transfer that happens between the end of those 60 days and the moment you finally contact the bank.1Consumer Financial Protection Bureau. 12 CFR Part 1005 – Liability of Consumer for Unauthorized Transfers There is no cap. A fraudster pulling $500 a month for six months after your deadline passes could leave you responsible for the full amount.
The bank does have to show that it could have prevented those later transfers if you had reported the problem within 60 days.1Consumer Financial Protection Bureau. 12 CFR Part 1005 – Liability of Consumer for Unauthorized Transfers In practice that is cold comfort, because the money is already gone and the showing is usually easy for the bank to make: once an account is known to be compromised, further charges can be blocked.
When a lost or stolen card is also involved, the tiers stack. You could owe up to $50 or $500 under the device-loss rules for the initial fraud, plus unlimited amounts for any transfers that occurred after the 60-day statement window expired without a report.
How the 60-Day Rule Differs From the Lost or Stolen Card Rules
Regulation E uses a tiered liability system, and the 60-day statement rule is only one piece of it. Which rule governs your situation depends on how the fraud came to your attention.
If your debit card or other access device is lost or stolen and you notify the bank within two business days of learning about the loss, your liability caps at the lesser of $50 or the total unauthorized charges before notice.1Consumer Financial Protection Bureau. 12 CFR Part 1005 – Liability of Consumer for Unauthorized Transfers Wait longer than two business days and the cap rises to $500, calculated as up to $50 for charges in the first two days plus the full amount of post-day-two charges the bank can show would have been prevented by earlier notice.3eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) – Section 205.6(b)(2)
The 60-day statement rule is different. It applies to any unauthorized transfer that appears on a periodic statement, whether or not a card was lost or stolen. Account takeover, ACH fraud, a compromised card number used online while the physical card never left your wallet: all of these ride on the statement timeline rather than the device-loss timeline. That is why reviewing statements matters even for people who have never lost a card.
Extenuating Circumstances That Extend the Deadline
Regulation E requires banks to extend the reporting deadlines when a delay is caused by extenuating circumstances. The regulation specifically identifies extended travel and hospitalization as qualifying examples.4eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) – Section 205.6(b)(4) If you were in the ICU for three weeks and physically unable to look at a statement, that gap cannot be held against you.
The regulation does not list every qualifying situation, so other serious circumstances could also justify an extension. The common thread is that something genuinely prevented you from reviewing your statement and contacting the bank. Being busy at work or forgetting to check your account will not qualify. If you believe extenuating circumstances apply, document them carefully and raise them the moment you call the bank.
What the Rule Does Not Cover
The 60-day statement rule is a Regulation E rule, and Regulation E only reaches certain accounts and transfer types. Knowing where it stops matters, because consumers often assume it covers losses that it does not.
The regulation applies to accounts held by individuals for personal, family, or household use. Business accounts, commercial accounts, and accounts held by LLCs or corporations fall outside its scope.5eCFR. 12 CFR 1005.2 – Definitions If a business checking account is drained by fraud, Regulation E will not help; the recourse depends on the commercial account agreement and the Uniform Commercial Code.
Several common transaction types are also excluded. Wire transfers through systems like Fedwire, securities and commodities transactions, check-based transfers, and one-time telephone-initiated transfers that are not part of a recurring payment plan all sit outside Regulation E.6Consumer Financial Protection Bureau. 12 CFR 1005.3 – Coverage A wire sent to a scammer is not protected by the 60-day rule.
Credit card fraud is governed by a different law entirely. Unauthorized credit card charges fall under Regulation Z, which implements the Truth in Lending Act and has its own liability limits and dispute procedures. The 60-day statement rule discussed here applies only to debit-side transactions from deposit accounts.
How to Report Before the Deadline Passes
Before calling the bank, pull together your account number, the date and dollar amount of each disputed transfer, and a brief reason you believe each one was unauthorized. Pointing out that your card was in your possession during a remote purchase, or that you were in another city when an ATM withdrawal happened, gives the bank something concrete to work with. The fraud phone number is usually printed on the back of the debit card or on your statement.
Verbal notification is enough to start the process and preserve your rights under Regulation E. The bank, however, can require you to follow up with a written confirmation within 10 business days of that call. When it imposes that requirement, it must tell you so during the call and give you the address.7Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors Skip the written follow-up when required and the bank can deny you provisional credit during its investigation. A lot of people get tripped up here: they make the phone call and assume they are done.
Send the written confirmation by certified mail with return receipt so you have proof of delivery. Get a claim or confirmation number during the initial call and write it on the letter. Keep copies of everything.
If the Bank Denies Your Claim
A denial is not the end of the road. Start by requesting the documents the bank relied on, which it is required to provide. Review them for errors or misunderstandings. If the investigation was sloppy or the reasoning does not hold up, say so in writing and ask the bank to reconsider.
If the bank will not move, you can file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint. Include a clear description with key dates and amounts, and attach supporting documents such as account statements and copies of your correspondence with the bank.8Consumer Financial Protection Bureau. Submit a Complaint The CFPB forwards the complaint to the bank, which generally must respond within 15 days. Get it right the first time, because you typically cannot submit a second complaint about the same issue.
Small claims court is another option for smaller dollar amounts. You would not need a lawyer, and the bank would have to send someone to defend. A well-documented paper trail combined with a bank that cannot show it followed Regulation E’s procedures often makes these cases straightforward.