If someone used your debit card without permission, freeze the card in your banking app and call your bank’s fraud line the same day. That is the core of what to do when someone uses your debit card: federal law under Regulation E caps your liability at $50 if you notify the bank within two business days of learning about the loss or theft, lets it rise to $500 if you wait longer, and removes the cap entirely once 60 days pass from the statement showing the charge. Every step below flows from that timing.
Freeze the Card First
Most banking apps have a one-tap freeze or lock. Use it before you do anything else. A freeze blocks new charges while you sort out which transactions are yours, and it costs you nothing to reverse if you find the card later.
With the card locked, pull up your recent activity and identify every charge you did not authorize. Write down the merchant name, date, and dollar amount for each one. Note the last purchase you know was legitimate too, because that marks when the compromise likely began. Charges from unfamiliar merchants in cities you have never visited are a pattern the fraud team recognizes quickly.
Call the Fraud Line and File a Report
Use the number on the back of your card or in your app. Most banks staff these lines 24 hours a day. The representative will read the suspicious transactions back to you, confirm which are unauthorized, and give you a claim or reference number. Save that number.
Under Regulation E, your bank is considered notified when you take “steps reasonably necessary” to provide the information, which includes a phone call, an in-person visit, or a written report.1Electronic Code of Federal Regulations. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers A phone call starts the clock. But your bank can require written confirmation within 10 business days of the oral report.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors If they do, they have to tell you during the call and give you an address. Miss that 10-day follow-up and the bank can close the investigation without issuing provisional credit, even though you reported on time by phone. Send the letter and keep a copy.
The bank will cancel the compromised card number permanently and mail a replacement, typically in five to seven business days. Some banks offer expedited shipping for a fee, and many can generate a temporary digital card number in the app so you can keep spending in the meantime.
How Much You Could Owe
The Electronic Fund Transfer Act and Regulation E set your maximum exposure based on how fast you notify the bank. The tiers are deliberately harsh to push people toward same-day reporting.
- Report before any unauthorized charges post: you owe nothing. Spotting a missing card and calling the bank before the thief uses it means zero liability.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report within two business days of learning about the loss or theft: liability caps at $50 or the total unauthorized charges, whichever is less.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Report after two business days but within 60 days of your statement being sent: liability can reach $500. The bank has to prove the later charges would not have happened if you had reported sooner.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Fail to report within 60 days of the statement: no cap. The bank has no legal obligation to refund unauthorized transfers that occur after the 60-day window closes.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
The two-day and $500 tiers apply specifically when the card or PIN was lost or stolen. If your card number was compromised without the physical card going missing, such as through a data breach or online skimming, the 60-day statement rule is what matters most. Report within 60 days of the statement showing the charge and you avoid liability for those transactions.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Practical advice does not change: report the moment you spot something wrong.
If a genuine hardship prevented you from reporting on time, the law requires the bank to extend the deadlines to a “reasonable period.” The statute names extended travel and hospitalization as qualifying circumstances.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability A third party can file on your behalf if you physically cannot. The extension is not automatic; expect to explain and document the situation.
When You Get Your Money Back
The bank has 10 business days from receiving your report to investigate and reach a decision. If it confirms the transactions were unauthorized, it must correct the error within one business day.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Straightforward cases involving charges at distant retailers often resolve within a few days.
When the bank needs more time, it can extend the investigation to 45 days, but only if it provisionally credits your account within the first 10 business days.5Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution That credit gives you full access to the disputed funds while the review continues, so rent and other payments will not bounce because the investigation is still open. The bank must notify you within two business days of the credit, stating the exact amount and date.
Newer accounts get different treatment. If the account was opened within 30 days of the first deposit, the bank has 20 business days to provisionally credit rather than 10, and the total investigation window stretches to 90 days.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
If the bank decides no error occurred, it can reverse the provisional credit. Before doing so it must send you a written explanation, notify you of the date and amount being debited, and honor checks and preauthorized payments from your account for five business days after the notification.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
Network Zero-Liability Policies
Your actual protection may be stronger than the federal minimum. Visa’s zero-liability policy covers most personal debit cards and states you will not be held responsible for unauthorized charges made in person or online, provided you used reasonable care with the card and notified your bank promptly. Visa requires issuers to replace stolen funds within five business days of notification.6Visa. Visa Zero Liability Policy
Mastercard offers a similar policy covering in-store purchases, online transactions, phone orders, mobile payments, and ATM withdrawals, as long as you protected the card with reasonable care and reported the problem promptly.7Mastercard. Mastercard Zero Liability Protection Policy
Both policies exclude commercial cards and anonymous prepaid cards like gift cards, and both require the transaction to have run through the Visa or Mastercard network. Funds credited under network policies can still be withheld or reversed based on investigation findings, so cooperate fully with the bank’s inquiry either way.
When to File a Police Report or FTC Report
A police report is not required to file a fraud claim with your bank, but it matters in specific situations. Many creditors require one to resolve disputes, and credit reporting agencies will automatically block fraudulent debts from your credit report when you provide a copy of the report.8Office for Victims of Crime. Steps for Victims of Identity Theft or Fraud If the fraud extends beyond your debit card, such as new accounts opened in your name, a police report gives you significantly more leverage.
The FTC’s IdentityTheft.gov site generates a formal identity theft report and a personalized recovery plan with checklists and sample letters.9Federal Trade Commission. IdentityTheft.gov – Report Identity Theft and Get a Recovery Plan The FTC does not resolve individual cases, but reports feed a federal database used by law enforcement. When a debit card compromise looks like part of a broader identity theft problem, filing with both local police and the FTC creates the strongest paper trail.
If the Bank Denies Your Claim
Banks sometimes conclude that no unauthorized transaction occurred. When that happens, the bank must provide a written explanation and tell you that you can request copies of the documents it relied on. On request, the bank must provide those documents promptly.10eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Read them carefully. If the reasoning rests on facts that are wrong or evidence you can rebut, reopen the dispute with your own documentation.
If the bank still will not budge, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov or by calling (855) 411-2372. The CFPB forwards the complaint to the bank, which generally responds within 15 days; more complex cases may get a final response within 60 days.11Consumer Financial Protection Bureau. Submit a Complaint Include your claim reference number, statements showing the disputed charges, and any communications with the bank. Include everything the first time.
Fraud Claims Are Not Merchant Disputes
Not every unwanted debit card charge counts as fraud. If someone stole your card number and bought electronics across the country, that is an unauthorized transfer and Regulation E applies. If you swiped your own card at a store and the product arrived broken or never showed up, that is a merchant dispute, and the rules are different.
Regulation E’s liability protections cover only transactions “initiated by a person other than the consumer without actual authority.” It does not treat a dispute over defective goods or undelivered services as an error.3eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Credit cards have federal protections that let you dispute charges for goods not delivered as agreed; debit cards do not. Your main recourse for a merchant dispute is to work it out with the merchant or use your bank’s voluntary chargeback process, which runs on card network rules rather than federal statute. Filing a fraud claim for something you know is not actually unauthorized can weaken your credibility with the bank.
Business Debit Cards Are Not Covered
Everything above applies to personal debit cards used for household purposes. Regulation E does not protect business accounts. The Electronic Fund Transfer Act covers only consumer accounts established primarily for personal, family, or household purposes.12Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs Business account fraud is governed by the Uniform Commercial Code and by your specific agreement with the bank, and those agreements often impose shorter reporting windows and higher liability thresholds than federal consumer law would allow. Check your account agreement.
Update Autopays and Digital Wallets After the New Card Arrives
When the replacement card arrives with a new number, every autopay tied to the old card will start failing. Utilities, streaming services, insurance premiums, and gym memberships are the usual culprits. Log into each provider’s payment portal and update the card details. Missed payments can trigger late fees, service interruptions, and credit report damage if they go unresolved.
Digital wallets like Apple Pay and Google Wallet do not always update automatically when a card is replaced after fraud. Remove the old card from each wallet and re-add the new one manually, then verify it works by making a small purchase. Missing a single linked service can create a chain of declined transactions days after you thought the problem was resolved.