When a fraudulent charge appears on your credit card, the person who pays for credit card fraud is almost never you. Federal law caps your personal liability at $50, and Visa, Mastercard, and most other major networks voluntarily reduce that to zero through their own policies. The actual cost lands on either the merchant or the card-issuing bank, and which one pays depends on how the transaction was processed and whose security measures fell short.
What the Cardholder Owes
Under 15 U.S.C. § 1643, your liability for unauthorized credit card charges cannot exceed $50, and that cap applies only when the issuer gave you adequate notice of potential liability, provided a way to report loss or theft, and included a method to identify authorized users.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card If any of those conditions is missing, your liability drops to $0. The $50 ceiling also covers only charges made before you notify your issuer. After you report the problem, you owe nothing for any further unauthorized use.
Most major networks go further than the statute requires. Visa’s Zero Liability Policy states that you will not be held responsible for unauthorized transactions on your Visa card, whether it was lost, stolen, or fraudulently used.2Visa. Zero Liability Mastercard offers the same guarantee, provided you used reasonable care protecting the card and promptly reported the loss or theft.3Mastercard. Mastercard Zero Liability Protection Policy These are voluntary network commitments rather than federal rights, but in practice they mean most cardholders pay nothing.
Two situations fall outside this protection. First, the law covers only truly unauthorized charges. If you handed your card to someone and later regretted the purchase, § 1643 does not apply. Second, Mastercard’s zero-liability policy excludes commercial cards and unregistered prepaid cards such as gift cards.3Mastercard. Mastercard Zero Liability Protection Policy
When the Merchant Pays
Merchants frequently absorb the cost of credit card fraud, especially in two situations: in-person transactions processed on outdated equipment, and online purchases where the card is not physically present.
The EMV Chip Liability Shift
Since October 2015, major payment networks have enforced a liability shift tied to EMV chip technology. When a chip-enabled card is used at a merchant that still relies on magnetic-stripe readers, the merchant absorbs the counterfeit fraud loss rather than the issuing bank. The underlying rule is that the party with the least secure technology bears the cost.4U.S. Department of the Treasury. EMV Merchant 101 If both the card and the terminal support chip authentication, standard network rules apply and the issuing bank typically pays.
This liability shift is not a federal law. It is a set of rules imposed by Visa, Mastercard, and the other networks, designed to push merchants toward upgrading their payment terminals. Fuel dispensers received an extended deadline, with the shift for gas pumps taking effect in October 2017.
Online, Phone, and Mail-Order Purchases
Online, phone, and mail-order purchases are classified as card-not-present transactions. Because the merchant cannot physically verify the card or the cardholder, the merchant generally bears the fraud liability when the true cardholder disputes the charge. To keep the money, the merchant must prove the authorized cardholder made the purchase, usually through records such as delivery confirmation to the billing address or device authentication data. Without that evidence, the payment network reverses the funds from the merchant’s account through a chargeback.5Mastercard. How Can Merchants Dispute Credit Card Chargebacks
Merchants can reduce this exposure by implementing 3D Secure authentication, a protocol branded as “Visa Secure” or “Mastercard Identity Check” that verifies the cardholder’s identity before the payment is processed. When a transaction is successfully authenticated through 3D Secure, the fraud liability shifts away from the merchant and back to the issuing bank.6Visa. 3D Secure – Your Guide to Safer Transactions
When the Issuing Bank Pays
The issuing bank pays for fraud when neither the cardholder nor the merchant can be held responsible. This happens when the merchant followed all security protocols (used a chip reader, authenticated through 3D Secure), when the fraud grew out of a sophisticated data breach outside anyone’s direct control, or when the bank’s own zero-liability guarantee requires it to cover the cardholder. Banks budget fraud-loss provisions each year specifically for these costs.
The issuing bank also runs the chargeback process, acting as the intermediary between the cardholder and the merchant’s acquiring bank. If the merchant contests a chargeback and provides compelling evidence that the transaction was legitimate, the issuer reviews both sides and makes a final decision. If the merchant misses the deadline to respond, it loses the chargeback by default.5Mastercard. How Can Merchants Dispute Credit Card Chargebacks Every dollar of fraud lands somewhere; the question is always which party’s security failure or contractual obligation makes them responsible.
How to Keep the Fraud Off Your Tab
The $50 cap and zero-liability policies only protect you if you use the dispute process correctly. A separate federal statute, 15 U.S.C. § 1666, treats unauthorized charges as billing errors and gives you a formal process to challenge them. You must send written notice to your card issuer within 60 days after the statement containing the fraudulent charge was transmitted to you.7Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors The notice must identify your account, say which charge is wrong, and explain why.
Once the issuer receives your notice, it must acknowledge it within 30 days and resolve the dispute within two complete billing cycles, and in no event more than 90 days. While the investigation is open, you do not have to pay the disputed amount and the issuer cannot try to collect it. If the issuer confirms the error, it must correct the charge and credit any related finance charges. If the issuer concludes no error occurred, it must send a written explanation and provide documentary evidence on request, and the disputed amount then becomes due under the original terms of your credit agreement.8eCFR. 12 CFR 1026.13 – Billing Error Resolution
Most issuers let you start the dispute through their mobile app or online banking. The formal protections of § 1666 require written notice sent to the address the issuer designates for billing inquiries, which is often different from the payment address.7Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Many consumers file through the app for speed and follow up with a certified letter for legal protection. Your issuer may also ask you to complete a fraud affidavit, and some creditors require a police report, particularly when a stolen identity or new account is involved.
Missing the 60-day window does not necessarily erase the $50 cap under § 1643, which has no reporting deadline of its own. But you lose the formal dispute process, including the right to withhold payment during the investigation, which makes recovering the money much harder in practice.
Your credit score is protected during this period. While the issuer investigates, it cannot threaten your credit rating or report the disputed amount as delinquent. If the investigation concludes the charge was valid, the issuer must give you at least ten days to pay before reporting any delinquency, and if you still refuse to pay, any delinquency report must also note that you continue to dispute the charge.9Office of the Law Revision Counsel. 15 USC 1666a – Regulation of Credit Reports
Debit Cards Are a Different Story
If the fraud hit a debit card rather than a credit card, the allocation of loss changes sharply, and more of it can land on you. Debit cards are governed by the Electronic Fund Transfer Act and Regulation E, which tie your liability directly to how quickly you report the problem:10eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
- Report within two business days of learning about the theft, and your liability is capped at $50.
- Report after two business days but within 60 days of your statement, and your liability can reach $500.
- Report more than 60 days after your statement, and you can be liable for the full amount of any unauthorized transfers that occur after the 60-day period, with no cap.
A credit card has a hard $50 federal cap no matter when you report, and network policies usually make it $0. A debit card can expose you to unlimited losses if you miss the 60-day review window.11Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers Extenuating circumstances such as a hospital stay must extend these deadlines by a reasonable amount, but if you have the choice, using a credit card gives you meaningfully stronger fraud protection.
Business and Corporate Cards
Section 1643 covers business credit cards, with one important exception. When an issuer provides cards to a business that distributes them to ten or more employees, the issuer and the business can negotiate their own liability agreement for unauthorized use, potentially shifting more of the cost to the business than the usual $50 cap would allow.12Office of the Law Revision Counsel. 15 USC 1645 – Business Credit Cards; Limits on Liability of Employees
No matter what that agreement says, neither the issuer nor the employer can impose liability on an individual employee beyond the $50 limit of § 1643.12Office of the Law Revision Counsel. 15 USC 1645 – Business Credit Cards; Limits on Liability of Employees The business may owe more than $50 for unauthorized charges on its corporate accounts, but the employee who carries the card cannot be held personally liable beyond the federal cap. Because Mastercard’s zero-liability policy also excludes commercial cards, business cardholders should review the specific issuer agreement rather than assuming full network protection applies.