If someone makes unauthorized debit card transactions on your account, your liability under federal law depends almost entirely on how fast you report the problem. Notify your bank within two business days of learning about the loss or theft and you cannot lose more than $50. Wait longer than two business days but report within 60 days of the statement showing the transfer and the cap rises to $500. Miss the 60-day window and you can be on the hook for every unauthorized transfer that happens after the deadline. Regulation E, which implements the Electronic Fund Transfer Act, sets these caps and the process the bank has to follow.1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
What Counts as Unauthorized
An unauthorized electronic fund transfer is one that someone else initiates from your account without your permission and without any benefit to you. Both elements have to be present.2eCFR. 12 CFR 1005.2 – Definitions A stolen card used at a store, a skimmed card number used online, a data breach that ends in fraudulent withdrawals: all covered.
Three situations are excluded. Transfers you make with fraudulent intent, or that someone acting with you makes. Transfers by the bank or a bank employee. And the one that catches people off guard: transfers by anyone you handed your card or PIN to. If you give your debit card to a roommate for groceries and they drain $800, that is not an unauthorized transfer, and the bank has no obligation to reimburse you unless you had already told the bank that person was no longer authorized to use your account.3eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Supplement I Official Interpretations – Section 1005.2(m) Sharing your card starts the clock on your own liability for whatever happens next.
P2P Payments: Fraud vs. Scam
Zelle, Venmo, and other peer-to-peer platforms fall under Regulation E. The CFPB has confirmed that if a fraudster pushes a transfer out of your account through a P2P app without your authorization, it counts as unauthorized and your bank must investigate and reimburse under the same rules.4Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
The line the regulation draws is who pushed the button. If someone hacks your account and sends themselves $500, that is unauthorized. If a scammer talks you into sending them $500 by pretending to be your bank’s fraud department, you authorized the transfer, even though you were deceived. Regulation E generally does not cover that second scenario.
The Liability Tiers When Your Card Is Lost or Stolen
When the physical debit card or access device is lost or stolen, federal law creates three tiers based on how quickly you notify the bank:1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report within two business days of learning about the loss or theft, and your maximum loss is $50, or the total unauthorized transfers before you reported, whichever is less.
- Report after two business days but within 60 days of the statement showing the unauthorized transfer, and your maximum loss rises to $500. The bank can hold you responsible for transfers after those first two days only if it can show earlier notice would have prevented them.
- Fail to report within 60 days of that statement, and you face unlimited liability for unauthorized transfers occurring after the 60-day window, as long as the bank can prove those later transfers could have been stopped with earlier notice.5Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
The two-day clock runs from when you learn about the loss or theft, not from when the theft happened. Card stolen January 1, noticed January 15? The two-day clock starts January 15. The 60-day clock is different: it runs from when your bank sends the periodic statement showing the unauthorized transfer.
Two rules work in your favor. The burden of proof is on the bank. It must show a transfer was authorized before it can hold you liable.6Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability And your own negligence, such as writing your PIN on the card, cannot be used to push your liability above what Regulation E allows.7eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Supplement I Official Interpretations – Section 1005.6(b)
When Only Your Card Number Is Stolen
The $50 and $500 tiers apply when the physical card is lost or stolen. If a thief gets only your card number, through a data breach, skimming, or online theft, and you still have the card in your wallet, the first two tiers don’t apply. Your only obligation is to report the unauthorized transfers within 60 days of the statement that shows them. Report within that window and your liability is zero.8Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers – Official Interpretation 6(b)(3)
Miss the 60 days and you become liable for unauthorized transfers that occur after the deadline passes and before you notify the bank, provided the bank can show those later transfers could have been prevented. That is why reviewing your monthly statements matters. A fraudster with your card number often runs small test charges for weeks before draining the account, and the 60-day clock runs whether or not you actually open the statement.
How to Report and Preserve the Cap
Contact your bank as soon as you find an unauthorized transaction. Call the number on the back of your card or the fraud hotline on the bank’s website. Most banks also take reports through their app or online portal. Speed matters more than format: an oral report by phone starts the clock and locks in the two-day window.
Have these ready when you call: your account number or another identifier the bank can use to find your account, the date and amount of each disputed transaction, the merchant name if there is one, and why you believe the transactions were not authorized.9Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors The report doesn’t have to be perfect. Notice is effective even without an account number, as long as the bank can identify the account another way, such as by Social Security number.
Many banks require you to confirm an oral report in writing within 10 business days. If yours does, it must tell you so on the first call and give you an address. The consequence of skipping the confirmation is real: the bank can withhold provisional credit if it asked for a written confirmation and you didn’t send one within 10 days.10eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Ask during the first call whether written confirmation is required, and send it by a method that leaves a trail, like certified mail or an email with a read receipt.
What the Bank Has to Do Next
Once your bank receives notice, it has 10 business days to investigate and reach a determination.11eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors For new accounts where the first deposit was made within the last 30 days, the bank gets 20 business days.
If the bank needs more time, it can extend the investigation only by crediting your account with the full disputed amount (minus up to $50 if it has a reasonable basis to believe an unauthorized transfer occurred) within those first 10 business days.10eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors That provisional credit lets you use the funds while the bank keeps working. The overall investigation has to be done within 45 calendar days of your notice.
The 45-day window stretches to 90 days in three situations: the transfer was initiated outside the United States, it resulted from a point-of-sale debit card transaction, or it occurred within 30 days of the account’s first deposit.11eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
When the investigation ends, the bank must notify you of its findings within three business days. If the bank confirms an error, provisional credit becomes permanent and the bank has one business day to correct the error, including refunding overdraft and other fees you were charged as a result of the unauthorized transfer.12eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Supplement I Official Interpretations – Section 1005.11(c)(4) If the bank finds no error, it must send a written explanation and can pull back the provisional credit after giving you notice.
If You Couldn’t Report in Time
When circumstances beyond your control kept you from meeting the deadlines, the bank must extend the notice periods to a reasonable time under the circumstances.1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers The underlying statute names extended travel and hospitalization as examples.6Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability Three weeks in the ICU means the two-day and 60-day clocks don’t run against you during that period. If you invoke this exception, document what happened and be ready to explain why you couldn’t report sooner.
If the Bank Denies Your Claim
A denial is not the end. When the bank concludes no error occurred, its written explanation has to tell you about your right to request the documents it relied on, and the bank must promptly provide copies when you ask.10eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Read them. Banks sometimes close investigations with minimal analysis, and the paperwork can show gaps in the reasoning.
File a CFPB Complaint
If the bank’s answer is unsatisfactory, submit a complaint to the Consumer Financial Protection Bureau at consumerfinance.gov/complaint. The CFPB forwards it to the company, which generally responds within 15 days; in more complex cases the company may take up to 60 days. You then have 60 days to review the response and provide feedback.13Consumer Financial Protection Bureau. Learn How the Complaint Process Works A complaint doesn’t guarantee reversal, but it creates a regulatory record, and banks often take a second look at disputes that reach the agency.
Sue Under the EFTA
The Electronic Fund Transfer Act gives you a private right to sue. In an individual action, you can recover your actual losses plus statutory damages between $100 and $1,000, plus attorney’s fees and court costs.14Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability Statutory damages are available even when your actual loss is small, which makes a lawsuit economically viable for moderate-dollar disputes.
The penalty gets bigger when a bank acts in bad faith. A court can award treble damages, three times the amount at issue, if it finds the bank failed to provide provisional credit within the 10-day window and either did not conduct a good-faith investigation or had no reasonable basis for concluding your account was not in error. The same treble-damage provision applies when a bank knowingly concludes there was no error despite evidence to the contrary.15Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution Mentioning these remedies in an escalation letter tends to focus attention.
Two Limits Worth Knowing
Regulation E only covers accounts established for personal, family, or household purposes. It defines a protected account as a consumer asset account and a consumer as a natural person.16eCFR. 12 CFR Part 205 – Electronic Fund Transfers, Regulation E If unauthorized debit card charges hit a business checking account, the federal liability caps and investigation deadlines described here do not apply. Your protection depends on the bank’s agreement and any applicable state law. Owners who use a single account for household and business spending should ask the bank how the account is classified.
Credit cards are governed by a separate law. Under the Truth in Lending Act, liability for unauthorized credit card use is capped at $50, flat, with no tiers and no unlimited exposure for late reporting.17Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card That is a different rule for a different product, and it does not apply to debit card fraud.