Unauthorized charges on your debit card or bank account: the bank must refund you (Regulation E)
Fraudulent debit card charges, ACH withdrawals you didn't approve, or a stolen card: federal law caps your loss at $50 if you report within 2 days, $500 within 60 days, and the bank must investigate in 10 business days and give provisional credit. How to report, what to say, and what to do when the bank denies the claim.
- Regulation E (Electronic Fund Transfer Act) covers debit cards, ATM withdrawals, ACH debits, and most app transfers from a bank account.
- Report an unauthorized transaction and your liability is capped: $0 to $50 if you report within 2 business days of learning about it; up to $500 if within 60 days of the statement; unlimited after that, so report immediately.
- The bank must investigate within 10 business days (20 for new accounts) or give you provisional credit while it takes up to 45 days (90 in some cases).
- You don't need a police report, and the bank can't require one to start. You can report by phone; follow up in writing.
- "Unauthorized" includes a stolen card, a skimmed number, an account taken over, or a merchant charging more than you approved. It does not include a payment you made yourself to a scammer (see Zelle and payment app fraud).
Your liability, by timing
| When you report | Your maximum loss |
|---|---|
| Within 2 business days of learning of the loss or theft | $50 (most banks: $0 under Visa/Mastercard zero-liability) |
| After 2 business days, within 60 days of the statement | $500 |
| After 60 days from the statement showing the first unauthorized transaction | Unlimited for transactions after the 60 days |
If the card was never lost or stolen (number skimmed, online fraud), liability is $0 for anything reported within 60 days of the statement.
What to do, in order
- Call the bank's fraud line today (number on the back of the card). Say: "I'm reporting unauthorized electronic fund transfers under Regulation E." List each transaction. Ask them to cancel the card and issue a new one. Note the date, time, and the case number.
- Follow up in writing through secure messaging or the bank's dispute form within 10 business days if they ask; the written notice starts the bank's error-resolution clock formally.
- Change your online banking password and review linked apps and payees. Remove unknown devices.
- Ask for provisional credit if the investigation goes past 10 business days. They must give it.
- Get the result in writing. If they deny, they must tell you why and give you the documents they relied on if you ask. Request them.
If the bank denies your claim
Common denials: "the transaction used your PIN," "the device was recognized," "you benefited from the purchase." None of those is legally sufficient on its own; the bank must show the transfer was actually authorized by you or someone you allowed to use the card.
- Reply in writing requesting the investigation documents and pointing out the specific reason the transaction wasn't yours (you were elsewhere, no such device, the merchant is unknown).
- File a CFPB complaint (free, online, 10 minutes). Banks answer within 15 days and a large share of Reg E denials get reversed at this stage.
- Complain to the bank's regulator (OCC for national banks, NCUA for credit unions, your state banking department otherwise) and your state attorney general.
- Sue: the EFTA allows actual damages plus statutory damages up to $1,000 and attorney's fees. Small claims works for the amount lost.
Merchant overcharges and recurring debits
If a merchant debited more than you authorized or kept charging after you canceled, that's also an "error" under Reg E. Report it the same way within 60 days. You can also revoke authorization for a recurring ACH debit by notifying the bank at least 3 business days before the next payment; the bank must then block it.
FAQ
The bank says I must file a police report first
They can ask, but they can't refuse to investigate without one. Say so and cite Regulation E, 12 CFR 1005.11.
I gave my card to my roommate and they overspent
That's not unauthorized under the rule if you gave access, unless you told them the limit and told the bank you revoked access. Report it anyway; many banks refund.
The fraud was on my credit card, not debit
Different law, similar result: see credit card chargeback and FCBA.
Prepaid cards and payroll cards
Covered by Reg E too, with the same timelines.