Report any unauthorized card transaction immediately. Federal rules differ by account type. For a lost or stolen debit card or PIN, notifying the bank within two business days can limit liability to $50; later notice can expose up to $500, and a 60-day statement deadline can affect later transfers. Credit-card liability is generally capped at $50 when legal conditions are met, and account-number-only theft generally creates no liability.
Fraud discussions often compare identical-looking card purchases without distinguishing money taken from a deposit account from credit extended by an issuer. The reader’s fastest safe deadline should control the response.
Start here: a practical action plan
- Open the cited agency page and use only the official site or phone number.
- Save dated screenshots, confirmation numbers, letters, statements, and a short call log.
- Replace every hypothetical amount and date with the facts from the affected account.
- Recheck the report or account after the stated processing period and escalate any unresolved error.
- Assuming one freeze, alert, dispute, or report protects every financial system.
- Giving a caller, text sender, or paid recovery service credentials, codes, money, or sensitive documents.
- Waiting for a complete explanation before stopping new losses and preserving evidence.
Identify the rail before counting the deadline
Determine whether the transaction used a debit card tied to checking, a credit card, a prepaid card, an ACH transfer, or a payment-app balance. Save the transaction date, statement transmission date, discovery time, and whether the physical card or PIN was lost. Those facts can change the rule.
Do not wait for a merchant investigation before notifying the issuer. Locking a card in an app can limit new attempts but may not count as a complete error notice. Call the verified number, ask for the case number and written follow-up instructions, and save the replacement-card plan.
Treat two business days as the debit-card alarm
CFPB guidance says a consumer who reports a lost or stolen debit card or access code within two business days can have liability limited to the lesser of $50 or the unauthorized transfers. Reporting later can allow liability up to $500 under the stated conditions.
If the physical card and code were not lost but an unauthorized transfer appears on a statement, notify the institution promptly and no later than 60 days after the statement was sent. Waiting longer can create liability for later transfers the bank shows could have been prevented by timely notice.
Worked example: Friday discovery makes Tuesday important
Example: Priya discovers a missing debit card Friday at 6 p.m. and sees a $760 withdrawal. Monday is the first business day and Tuesday is the second under this simplified calendar with no holiday. Priya reports Friday rather than calculating whether an after-hours call changes the count.
If the applicable conditions are met, prompt notice can cap the example exposure at no more than $50 rather than as much as $500 after the two-business-day tier. The bank investigates the actual facts, and network zero-liability policies may be more protective than federal minimums.
| Event | Example amount or date | Planning meaning |
|---|---|---|
| Unauthorized debit | $760 | Report now |
| Discovery | Friday | Start record |
| Second business day | Tuesday | Federal tier marker |
| Potential federal tier | Up to $50 | Conditions still matter |
Keep the credit-card dispute record separate
For unauthorized credit-card use, federal liability cannot exceed $50 when the statutory conditions are met, and a consumer generally has no liability when only the account number is stolen. Many issuers provide zero-liability policies, but report immediately to stop additional charges.
A billing-error notice has its own statement-based process. Follow the address and instructions on the statement, preserve a copy, and continue paying undisputed amounts. Do not import the debit-card two-day and 60-day framework into every credit-card dispute.
- Identify the payment rail and missing access device.
- Report through the verified provider immediately.
- Record the statement date and case number.
- Follow written instructions without missing the shortest deadline.
Frequently asked questions
What is the safest deadline for reporting card fraud?
Immediately. The shortest legal tier can depend on whether a debit card or access code was lost.
What happens if I report a lost debit card within two business days?
Federal liability can be limited to the lesser of $50 or the unauthorized transfers when the required conditions are met.
What is the 60-day debit deadline?
It generally runs from the statement transmission date and affects liability for later unauthorized transfers if notice is delayed.
Is credit-card liability always $50?
Federal liability is capped at $50 when the statutory conditions apply, and issuers often offer more protection.
What if only my credit-card number was stolen?
CFPB guidance says a cardholder is not responsible for unauthorized charges when only the account number was stolen.
Does locking the card count as reporting fraud?
Do not assume it does. Contact the issuer, open a case, and follow its written notice instructions.
Sources and review notes
The calculations and scenarios in this guide are original BreadWinnr worked examples. We recalculated each example and checked that its parts match the stated total. Official sources support the financial concepts. Forum links document the reader problem that prompted the guide and are not treated as financial authority.
- CFPB, unauthorized bank transaction response
- CFPB, Regulation E consumer liability
- CFPB, watch accounts when card data is stolen
Read our research, testing, corrections, and source policy.
This guide provides general financial education. It does not account for your complete financial, tax, legal, or contractual situation.
Make the example yours.
Use the safe-to-spend calculator to try a different starting point.