If you spot an unauthorized transaction on your debit card, call your bank’s fraud department right now and cancel the card. That phone call starts the clock on your federal protections, and under the Electronic Fund Transfer Act your maximum liability jumps from $50 to $500 to potentially unlimited losses depending on how long you wait. Everything else — the written dispute, the police report, the complaint to regulators — matters, but none of it matters as much as reporting quickly.
Call the Bank and Cancel the Card
Use the fraud number on the back of your card or on your bank’s website. Tell the representative to cancel the compromised card and block the account so no further withdrawals clear. Don’t wait until you’ve gathered paperwork or itemized every bogus charge; the reporting date is what controls your liability, not the completeness of your file.
While you’re on the phone, write down the date, the time, and the full name of the person you spoke with. Ask for a reference or case number. Banks sometimes dispute when a customer first reported fraud, and that one-line note in your own handwriting can be the difference between a $50 loss and a much larger one.
Follow Up in Writing
Your call gets the investigation started, but banks are allowed to require written confirmation within 10 business days. If the bank told you written notice was required and you don’t send it, the bank isn’t obligated to issue a provisional credit while it investigates. Send something in writing every time, even if the phone rep didn’t bring it up.
The written notice should identify you and your account, list the transactions you believe are unauthorized with their dates and amounts, and explain why you think they’re wrong. Email or your bank’s secure message system creates a timestamped record that’s harder to lose than mail. Keep copies of everything.
The hard outer deadline is 60 days from the date the bank sent the statement showing the first unauthorized transaction. After that window closes, federal protections fall away for any fraudulent charges posted beyond it.
How Much You’ll Owe Depends on When You Report
The Electronic Fund Transfer Act sets a tiered liability structure, and the tiers penalize delay.
- Report within 2 business days of learning the card was lost or stolen: maximum liability is $50, or the total unauthorized transfers before you reported, whichever is less.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report after 2 business days but within 60 days of the statement: maximum liability rises to $500.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report more than 60 days after the statement showing the first unauthorized charge: no cap on losses from charges posted after that 60-day window closed.1Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
The statute allows the deadlines to be extended for “extenuating circumstances” such as hospitalization or extended travel, but relying on that exception is a bad bet.
When the Card Was Never Out of Your Wallet
The $50 and $500 tiers apply only when the physical card or PIN was lost or stolen. If someone grabbed your card number through a data breach, a skimmer, or an online hack and you still have the card itself, those two tiers don’t apply. Your only deadline is the 60-day one: dispute within 60 days of the statement that first showed the fraud and you aren’t liable at all; wait longer and you’re exposed to unlimited losses on charges posted after the window closed.2Consumer Financial Protection Bureau. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers
Card-not-present fraud — online purchases, phone orders, charges from a merchant you’ve never heard of — is now far more common than someone physically swiping your card. If the card is still in your wallet, federal law puts you in a stronger position, provided you report within 60 days.
Zero-Liability Policies Usually Go Further
The federal caps are the legal floor. Visa and Mastercard both publish zero-liability policies that promise you won’t be charged for unauthorized transactions, with Visa requiring the issuer to replace your funds within five business days of your report.3Visa. Visa Zero Liability Policy Mastercard’s policy covers unauthorized transactions at stores, online, by phone, on mobile devices, and at ATMs.4Mastercard. Mastercard Zero Liability Protection Policy
Both policies carry conditions. You must have used “reasonable care” with the card and reported promptly. Neither covers commercial cards or anonymous prepaid products. Visa also warns that provisional funds can be withheld or clawed back based on the investigation, your reporting delay, or your account history. These are network rules, not statutes, so you can’t sue to enforce them the way you can enforce EFTA rights. Still, most customers with a major-network debit card who report quickly end up paying nothing.
What the Bank Has to Do Once You Report
After the bank receives your notice of error, it has 10 business days to investigate and reach a conclusion. If the account was open less than 30 days when the fraud occurred, the bank gets 20 business days for the initial review.5Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account
If the bank can’t finish in that window, it may extend the investigation to 45 calendar days, but only if it first posts a provisional credit for the disputed amount so you have access to the money while the review continues. The extension stretches to 90 calendar days for three categories: transactions initiated outside the United States, point-of-sale debit card purchases, and transactions on accounts open less than 30 days.6Consumer Financial Protection Bureau. Regulation E – 1005.11 Procedures for Resolving Errors
The bank must tell you the outcome within three business days of finishing. If the charges were unauthorized, any provisional credit becomes permanent and the bank must refund fees caused by the fraud, such as overdraft or NSF fees triggered by the fraudulent withdrawals. Fees that would have been charged anyway don’t have to be reversed.6Consumer Financial Protection Bureau. Regulation E – 1005.11 Procedures for Resolving Errors
If the bank concludes no error occurred, it can pull back the provisional credit, but it has to send you written notice of the date and amount first. It also has to honor checks and preauthorized payments for five business days after that notice so the clawback doesn’t trigger a cascade of bounced payments and overdraft charges.
If the Bank Denies Your Claim
Denials happen more often than people expect, and the denial letter is not the end of the road. Ask for the documents the bank relied on. You’re entitled to understand why it decided the transactions were authorized.
If the reasoning doesn’t hold up, or if the bank missed any of the required timelines — the investigation deadline, the provisional credit rule, the three-day notification — file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov or by calling (855) 411-2372. The CFPB forwards your complaint to the bank, which generally has to respond within 15 days and no more than 60 for complex cases.7Consumer Financial Protection Bureau. Learn How the Complaint Process Works Complaints go into a public database, which tends to focus a bank’s attention.
You can also complain to the Office of the Comptroller of the Currency if your bank is a national bank, or to your state attorney general. For larger losses, a consumer protection attorney is worth consulting; EFTA allows recovery of actual damages, statutory damages, and attorney’s fees when a bank violates its obligations.
A police report isn’t required for the bank to investigate, and the CFPB has said banks cannot delay an investigation while waiting for extra documents from you.8Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs Filing one is still useful. It creates an independent record of the fraud if the bank pushes back, and some banks ask for it.
Business Debit Cards Are a Different Story
Everything above applies to personal accounts. The EFTA’s liability caps and investigation timelines don’t cover business debit cards, because the statute defines a covered “account” as one established primarily for personal, family, or household purposes.9Office of the Law Revision Counsel. 15 USC 1693a – Definitions Business accounts are governed instead by UCC Article 4A, which has its own rules on ordinary care, a 90-day reporting standard for preserving your right to interest, and a one-year outer bar on challenging a transaction after notification.10Legal Information Institute. UCC Article 4A – Funds Transfer Visa and Mastercard’s zero-liability policies also exclude commercial cards. If you own a business, your deposit agreement is your primary protection — read it before you need it.
Lower Your Exposure Going Forward
Check your transaction history at least weekly through your bank’s app or online banking. People who wait for a paper statement are the ones who blow past the 60-day deadline. Set up transaction alerts for any charge over a low threshold like $1, since most fraud starts with a tiny test charge before the real withdrawals hit.
For purchases, consider using a credit card instead of a debit card. Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, with no escalating tiers, and most major issuers voluntarily offer $0 liability.11Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card More importantly, a credit card dispute involves the issuer’s money, not cash already pulled from your checking account. If you prefer debit for budgeting, use it at ATMs and keep retail and online purchases on a credit card. That alone takes your checking account out of the line of fire for the kinds of fraud most likely to drain it.