If someone used your debit card without your permission, freeze the card in your banking app right now, then call your bank to report every charge you didn’t authorize. Doing both within two business days of noticing the fraud caps your personal liability at $50 under federal law, and most Visa and Mastercard debit cards knock even that down to zero.1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Wait longer and your exposure climbs fast. What you do in the next hour matters more than what you do tomorrow.
Freeze the Card First
Open your bank’s mobile app and look for a “lock card” or “freeze card” toggle. It stops new transactions instantly. If you can’t find the setting, call the number on the back of the card. Either way, do this before you start documenting charges, because every minute the card is live is another minute the thief can keep spending.
Then change your online banking password and your debit card PIN. If the same password protects other accounts, change those too. Thieves who have your card number sometimes also have login credentials pulled from a data breach, and rotating passwords closes that door. Turn on transaction alerts for every purchase so nothing slips past you again.
Check what else that card number touches. Savings accounts with automatic transfer privileges, overdraft lines, and payment apps like Venmo or PayPal that have your debit card on file are all exposed. Remove the compromised card from those services right away.
Report the Unauthorized Charges to Your Bank
Pull up your statement and write down the date, merchant name, and exact dollar amount of every transaction you don’t recognize. Having the list ready makes the call shorter and keeps anything from being missed.
You can file the dispute by phone, in the app, at a branch, or through an online form. However you do it, get a written confirmation with a reference number. That number is your proof of when you reported the fraud, and the reporting date is what determines how much of the money you’re entitled to get back.
Once the dispute is filed, the bank investigates. In most cases it has to issue a provisional credit putting the disputed funds back in your account within 10 business days while it finishes looking into things, so you shouldn’t be locked out of your own money for long.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Point-of-sale debit purchases can push the full investigation window out to 90 days, but the provisional credit obligation still applies. When the investigation ends, the bank must notify you in writing within three business days.
How Much You Could Owe
Federal law, specifically the Electronic Fund Transfer Act and Regulation E, ties your maximum liability to how fast you report. The rules split depending on whether a physical card was taken or just the card number.
Lost or Stolen Physical Card
Report within two business days of learning the card is missing and your liability is capped at $50. Report after two business days but within 60 days of your statement date and the cap rises to $500 for charges that happened after the two-day window closed.1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
Miss the 60-day window and the ceiling comes off. For unauthorized transfers that happen after those 60 days pass, there is no dollar cap on what you can lose, and you still owe the $500 from the earlier tier on top of that.3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability A thief who keeps using the account between day 61 and the day you finally call can drain it entirely.
Card Number Stolen Without the Card
This is the common scenario: a data breach, a gas-pump skimmer, an online hack. The $50 and $500 tiers don’t apply here. Only the 60-day statement rule matters. Report the unauthorized charges within 60 days of the statement showing them and your liability is zero under Regulation E.1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Blow past 60 days and the same uncapped exposure kicks in.
A hospitalization, extended trip, or similar event that kept you from reviewing statements on time can extend these deadlines to a reasonable period. You’ll have to explain the circumstances, and the bank decides what counts as reasonable.3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Visa and Mastercard Zero-Liability Protection
Federal law sets the floor. The card networks usually do better. Visa’s zero-liability policy covers most debit cards and requires the issuing bank to replace stolen funds within five business days of notification.4Visa. Visa Zero Liability Policy Mastercard offers similar protection for in-store, online, phone, and ATM transactions.5Mastercard. Mastercard Zero Liability Protection Policy Both exclude commercial and anonymous prepaid cards. Both require that you used reasonable care with the card and reported the fraud promptly.
In practice, most people with a Visa or Mastercard debit card from a major bank will get every dollar back and pay nothing out of pocket. The network policies matter most in the gap between day three and day 60 after a lost card, where Regulation E alone would allow a bank to charge you up to $500. The network rules override that and hold you at $0.
Overdraft Fees and Bounced Payments Caused by the Fraud
Fraudulent withdrawals don’t stop at the amount stolen. They trigger overdraft fees, non-sufficient-funds charges, and sometimes returned-payment fees on your legitimate bills. When the bank confirms an unauthorized transfer, Regulation E requires it to refund any fees it charged you as a result.6eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E During the provisional credit period, the bank also has to honor checks and automatic payments without charging overdraft fees for five business days after telling you about the credit.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
Ask for the fee reversals explicitly when you file the dispute. Don’t assume. If a utility or insurance company hit you with a late fee because the fraudulent withdrawal left your account short, contact that company directly with a copy of your fraud claim. Most will waive the fee once they see the payment failed because of fraud rather than neglect.
Reports to File Outside the Bank
The bank handles the money. Outside reports build a paper trail that protects you if the fraud turns out to be part of a larger identity theft problem or if you later need to challenge a denial.
IdentityTheft.gov, run by the FTC, walks you through filing a report in about 10 minutes and generates an Identity Theft Report plus a personalized recovery plan.7Federal Trade Commission. Identity Theft: IdentityTheft.gov The FTC won’t investigate your individual case, but the report becomes official documentation you can hand to credit bureaus, your bank, or anyone else who needs proof you were a victim.
A police report with your local department creates a separate criminal record of the incident. Not every department actively investigates debit card fraud, but the case number is useful if you need to prove the timeline later or escalate a dispute.
If the Bank Denies Your Claim
Banks deny fraud claims more often than people expect, sometimes because their investigation flagged a transaction as legitimate based on IP address, location data, or spending patterns. A denial isn’t the end of it.
Ask for the evidence. The written denial has to tell you that you can request the documents the bank used to reach its decision.2eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors Sometimes the file reveals an obvious mistake, like the bank matching a transaction to your IP address when the charge actually came from a VPN or shared network. Other times it tells you exactly what to rebut.
If the bank won’t reconsider, file a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov or by phone at (855) 411-2372.8Consumer Financial Protection Bureau. Learn How the Complaint Process Works The CFPB forwards your complaint directly to the bank, which generally has 15 days to respond. A regulator contacting the bank often produces a different outcome than your original call to customer service did.
If the bank violated Regulation E (failing to investigate, skipping the provisional credit, ignoring the timelines), you can sue under the Electronic Fund Transfer Act. A successful claim recovers your actual losses, statutory damages between $100 and $1,000, and attorney fees and court costs.9Office of the Law Revision Counsel. 15 USC 1693m – Civil Liability The attorney-fees provision means a lawyer may take the case even when the disputed amount alone wouldn’t justify it. Small claims court works for straightforward disputes under your state’s dollar threshold.
Replace the Card and Update Recurring Payments
Your bank will cancel the compromised card and mail a replacement with a new number. Every automatic payment tied to the old number will fail unless you update it. Build the list before the old card is deactivated: utilities, insurance, streaming, gym, app stores, anything that charges monthly or annually. Log into each provider and swap in the new details.
Annual subscriptions are easy to forget. Scroll back through 12 months of statements to catch anything infrequent. A failed insurance payment can lapse coverage without any warning. After the switch, watch the first two statements on the new card closely to confirm every automatic payment reconnected and that no unauthorized charges followed you over.