Unauthorized debit card charge: the steps and deadlines that limit your loss

The clock that decides your loss

Debit card fraud is governed by the Electronic Fund Transfer Act and its Regulation E. Your maximum loss depends on two things: whether the card or PIN itself was lost or stolen, and how fast you tell the bank. [1][2]

For a lost or stolen card, the regulation caps liability at the lesser of $50 or the amount taken if you notify the bank within 2 business days after learning of the loss. Business days exclude the day you learn of it and any non-business day. [2] Report later and the cap rises to $500. [2] Separately, you must report unauthorized transfers within 60 days of the bank sending the statement that shows them; otherwise you can be liable for later transfers the bank shows would have been prevented by timely notice, which the official commentary calls potentially unlimited liability. [2] The FTC adds that this can include money in linked accounts. [4]

Worked example: same theft, two outcomes

Illustration with assumed amounts. On Monday you realize your debit card is missing. A thief spends $200 that Monday and another $900 later in the week.

Outcome A: you call the bank on Wednesday. Business days exclude the day you learn of the loss, so Tuesday and Wednesday are your two business days. Your liability is capped at $50. [2]

Outcome B: you wait until the following Monday. Your cap rises to $500: up to $50 for transfers in the first two business days, plus later transfers the bank shows would not have happened had you reported in time, up to $500 in total. [2] Same theft, up to $450 more out of your pocket for waiting five days.

Exceptions: if a delay was caused by extenuating circumstances such as extended travel or hospitalization, the bank must extend the time limits to a reasonable period. [2] And carelessness does not raise the cap; the commentary says writing your PIN on the card does not change liability, which depends solely on how promptly you report. [2]

Step by step: what to do today

Notice counts once you take the steps reasonably necessary to give the bank the pertinent information, in person, by phone or in writing, and written notice counts when it is sent. You do not need to reach a particular employee. [2]

• Call the bank or use its mobile app to report the card lost or stolen and the charges unauthorized; you are not responsible for charges after you report. [4]
• Lock or cancel the card in the app or on the call and ask for a replacement number.
• Keep notes from every call with the bank, including the date and who you spoke with. [4]
• Follow up immediately in writing, listing the charges, when you noticed them and when you first reported, and keep a copy of the letter. [4]
• If the bank asks you to confirm in writing, do it within 10 business days; if you do not, it does not have to give provisional credit. [1][3]
• Review your statements for other charges you did not make and report all of them within 60 days after the statement showing them was sent. [1][3]
• Turn on multi-factor authentication for online banking where available. [4]
• Ask for the documents the bank relied on if it denies your claim. [1]

Password manager with a built-in authenticator: convenience vs separation — Password Managers Compared — If the charge came through a compromised online banking login, decide where your bank's two-factor codes should live.

What the bank must do, and by when

Regulation E sets the bank's side of the timeline. Your notice must reach the bank no later than 60 days after it sent the statement that first showed the error. [3] The bank must investigate and decide within 10 business days, report results within 3 business days after finishing, and correct a confirmed error within 1 business day. [3]

If it needs more time it can take up to 45 days, but only if it provisionally credits your account within 10 business days of your notice, tells you the amount and date within 2 business days of crediting, and gives you full use of the money. For a suspected unauthorized transfer it may hold back up to $50. [3] If it later decides the charge was authorized, it must notify you before reversing the credit and honor your checks and preauthorized payments for 5 business days afterward without overdraft fees caused by the reversal. [3]

If the bank stalls or denies the claim

You can ask for the information the bank used to reach its decision. [1] If the bank misses the deadlines above or you disagree with the outcome, file a complaint with the CFPB. The form asks for key facts in your own words with the most important dates and amounts, accepts up to 50 pages of documents such as statements and your letters, and routes the complaint to the company. Most companies respond within 15 days, some within 60. Because you generally cannot submit a second complaint about the same problem, include everything the first time. You can also file by phone at (855) 411-2372. [6]

Debit vs credit card fraud protection

Credit cards carry lower caps. The FTC lists $0 if you report a lost credit card before it is used and up to $50 after, and $0 when only the account number is used. [4] The CFPB says many cardholder agreements waive even the $50. [5] The bigger practical difference: debit fraud takes money out of your checking account, and you may wait up to 10 business days for provisional credit, [3] while a credit card charge sits on a bill you have not yet paid.

If you use a debit card for online shopping or at fuel pumps, consider moving that spending to a credit card you pay in full, and keep checking balances low enough that a frozen claim does not stop rent or bills.