If someone uses your debit card without permission, federal law can cap what you owe at $50, $500, or nothing at all, depending on how quickly you report the fraud and whether the thief had your physical card or just your card number. The money comes back through your bank, which has strict deadlines to investigate and credit your account. Speed is the single biggest factor in how much you recover, so the first step is always the same: call the number on the back of your card and report the charges as soon as you spot them.
How Much You Could Owe
The Electronic Fund Transfer Act and Regulation E set up a tiered system that rewards fast reporting. When your physical debit card is lost or stolen, three windows apply:
- Within two business days of discovering the loss: Your maximum liability is $50, or the total of the unauthorized charges if that’s less.
- After two business days but within 60 days of your statement: Your maximum liability rises to $500, and only if the bank can show the extra charges would not have happened had you reported sooner.
- After 60 days from the statement: You lose federal protection for unauthorized charges that occur after that 60-day mark and before you finally notify the bank. Charges already on the statement you failed to dispute remain protected; it’s the new fraud the bank could have prevented that falls on you.1eCFR. 12 CFR 205.6 – Liability of Consumer for Unauthorized Transfers
When only your card number is stolen — a skimmer at a gas pump, a retailer data breach, a phishing email — the tiers above don’t apply. If the fraudulent transfer was made without the physical card, and you report within 60 days of the statement that shows the charge, your liability is zero.2Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Most modern debit card fraud falls into this card-not-present category, and the protection is actually stronger than the lost-card scenario.
Visa and Mastercard layer their own zero-liability policies on top of federal law. Visa’s policy covers unauthorized charges on Visa-branded debit cards for in-store, online, and mobile purchases, with exclusions for certain commercial cards and anonymous prepaid products.3Visa. Zero Liability Policy Mastercard’s version is nearly identical and extends to ATM withdrawals, with the same exclusions for commercial and unregistered prepaid cards.4Mastercard. Zero Liability Protection Policy Both require that you took reasonable care with your card and reported promptly. In practice, most consumers end up paying nothing — but only if the report goes in quickly.
What Counts as “Unauthorized”
Regulation E defines an unauthorized transaction as one initiated by someone other than you, without your permission, from which you received no benefit. A stranger buying electronics with your stolen card number qualifies. Your roommate using the card you handed them does not.
If you gave someone your card or PIN — a partner, a teenager, a friend — anything they charge is treated as authorized under federal law until you formally tell the bank you’ve revoked that person’s access.5eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) You can’t lend out the card on Monday and dispute Friday’s charges as fraud. To end that person’s authorization, call the bank, say the person is no longer authorized, and ask for a new card number. Anything they charge after that notification becomes genuinely unauthorized.
Reporting the Fraud
Call your bank’s fraud department the moment you see a charge you didn’t make. The number is on the back of your card and in the bank’s app. Don’t wait to assemble a perfect file first — get the report logged, then gather details. The bank will cancel the compromised card and send a replacement, usually within five to seven business days, with rush delivery available for a fee that generally runs $12 to $40.
Have these ready during or right after the call:
- Date, dollar amount, and merchant name for each charge you didn’t authorize.
- When you first noticed the fraud, and, if the card was stolen, when you last had it.
- Your account number and current contact information.
- A brief explanation of why the charges are wrong, such as “I did not make these purchases” or “my card was stolen.”6Federal Trade Commission. Sample Letter for Disputing Credit and Debit Card Charges
If the card was physically stolen, file a police report. Officers may not investigate a single stolen card, but the report number strengthens your bank claim and matters if the theft turns out to be part of broader identity theft.
Written Follow-Up
Your bank can require you to confirm the verbal report in writing within 10 business days. If it does, it must tell you about the requirement during the first call and give you the address.7eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Don’t skip this. If the bank asks for written confirmation and you don’t send it in time, the bank no longer has to provisionally credit your account while it investigates.
Broader Identity Theft
If you think the problem goes beyond one card — someone opened accounts in your name, used your Social Security number, or filed in your name — report it at IdentityTheft.gov. The FTC’s site generates an Identity Theft Report and a personalized recovery plan. The report is formal proof to banks and businesses that your identity was stolen and triggers legal rights a routine fraud call does not.8Federal Trade Commission. What To Do Right Away
What the Bank Must Do, and When
Once you report, the bank has 10 business days to investigate and tell you whether an error occurred. If it confirms the fraud within that window, it must correct the error within one business day, so the money comes back fast.9Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
More complex cases run longer. If the bank can’t finish in 10 business days, it can take up to 45 days, but only if it provisionally credits your account within those first 10 days. The provisional credit must cover the full disputed amount, less up to $50 if the bank has reason to believe you bear some liability. You have full use of the money while the investigation continues.7eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
Three situations stretch the deadline from 45 days to 90:
- Foreign transactions, where the fraudulent charge originated outside the United States.10Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account
- Point-of-sale debit transactions at a retail terminal.
- New accounts, where the disputed transfer happened within 30 days of the first deposit.7eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
New accounts also get 20 business days instead of 10 before provisional credit is required. If the bank confirms fraud, the provisional credit becomes permanent. If the bank decides the charges were authorized, it can reclaim the provisional funds, but it must give you written notice and at least five business days before debiting the money.
Overdraft Fees and Cascade Charges
Fraud often triggers overdraft fees, returned-payment charges, and non-sufficient-funds penalties on legitimate transactions that posted after the thief drained the account. Federal law requires the bank to refund any fees it imposed as a result of the unauthorized transfer once it confirms the fraud.5eCFR. 12 CFR Part 205 – Electronic Fund Transfers (Regulation E) Banks don’t always do this on their own. When you file the dispute, say explicitly that you want every overdraft and related fee caused by the fraudulent activity reversed. Match dates and amounts of the fees to the fraudulent charges so you can push back if the refund covers only the stolen money and not the cascade of penalties it set off.
Automatic Payments After Your Card Is Replaced
Canceling a compromised card breaks every recurring payment tied to the old number. Streaming services, insurance premiums, gym memberships, and utility autopay will all fail on the next billing cycle unless you update them.
Visa and Mastercard both run account-updater services that push new card details to participating merchants. Visa’s Account Updater sends “closed account advices” when a card is reported lost or stolen and can route the new number to authorized merchants while blocking any the bank flags for fraud.11Visa Developer. Visa Account Updater FAQs Mastercard’s Automatic Billing Updater works the same way for recurring and stored-credential payments.12Mastercard Developers. Automatic Billing Updater
Don’t rely on these alone. Not every merchant participates, and updates can take a billing cycle to propagate. List every autopay tied to the old card and update each one manually. A missed insurance premium or loan payment can trigger late fees and coverage lapses that are harder to unwind than the fraud itself.
Charges Through Venmo, Zelle, or Cash App
If someone accesses your payment app and sends money using your linked debit card, Regulation E still applies. Federal law covers any transfer initiated through an electronic terminal, phone, computer, or app that debits a consumer account, and debit card pass-through payments qualify.13eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) Subpart A The liability limits and investigation timelines above apply.
Banks and apps sometimes point at each other. Start with your bank. Regulation E puts the error-resolution duty on the financial institution that holds your account. If the bank refuses to investigate, escalate.
Business Debit Cards Are Not Covered
Regulation E protects consumer accounts, defined as those established primarily for personal, family, or household purposes and held by a natural person.13eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) Subpart A Business checking accounts and commercial debit cards fall outside that definition. If your business card is compromised, you can’t rely on the federal liability caps or the provisional-credit requirement. Those disputes are governed by the bank’s own terms and, to some extent, the Uniform Commercial Code, where liability turns on whether the bank used a commercially reasonable security procedure and whether the business exercised ordinary care in catching and reporting the fraud.
If the Bank Won’t Fix It
Banks don’t always follow the rules. If yours ignores the report, refuses provisional credit, or denies the claim without a clear explanation, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint. The CFPB forwards the complaint to your bank and requires a response, usually within 15 days. Online submission takes about 10 minutes; the phone line is (855) 411-2372. Include the account number, the disputed charges, and a clear description of how the bank failed to investigate, with copies of your correspondence attached.14Consumer Financial Protection Bureau. Submit a Complaint Banks take CFPB complaints seriously because the data is public and regulators watch patterns.
Consider placing a fraud alert or credit freeze with Equifax, Experian, and TransUnion if any personal information beyond the card number may have been exposed. A fraud alert is free, lasts one year, and requires creditors to verify your identity before opening new accounts. A credit freeze is also free and blocks new credit applications entirely until you lift it. To place a fraud alert you only have to contact one bureau; it must notify the other two.15Federal Trade Commission. Credit Freezes and Fraud Alerts A thief who has your name, address, and Social Security number can do far more damage than drain a checking account.