Under the Electronic Fund Transfer Act (EFTA) and its implementing Regulation E, U.S. consumers are protected against unauthorized debit card transactions and electronic fund transfers (EFTs). Your legal liability for unauthorized charges is not zero by default; instead, it is determined by how quickly you notify your financial institution after discovering the loss, theft, or unauthorized activity. If you report a lost or stolen card within two business days, your liability is capped at $50. If you wait longer, your potential loss can increase to $500 or the entire amount taken from your account.

What Controls the Issue

The primary authority governing unauthorized debit transactions in the United States is the Electronic Fund Transfer Act (EFTA), specifically Regulation E (12 CFR Part 1005). This federal law establishes the rights, liabilities, and responsibilities of participants in electronic fund transfer systems.

It is important to distinguish these rights from other frameworks:

• Consumer vs. Business: Regulation E protections generally apply only to consumer accounts held by natural persons for personal, family, or household purposes. Business debit cards are typically governed by the contract between the bank and the business, not the EFTA.
• Debit vs. Credit: The EFTA covers debit cards and ACH transfers. Credit card disputes are governed by the Fair Credit Billing Act (FCBA), which has different liability caps and dispute timelines.
• Legal Right vs. Network Policy: While card networks like Visa or Mastercard may offer "Zero Liability" policies, these are private contractual promises. The EFTA provides the underlying legal floor that all U.S. banks must follow.

Consumer Liability Limits

Your financial responsibility for unauthorized transactions depends on the timeline of your report to the bank. The "clock" for the two-day window begins when you learn that your card or access device is missing. The "clock" for the 60-day window begins when the periodic statement containing the unauthorized transfer is sent to you.

If the unauthorized transfer did not involve the loss or theft of a physical card (for example, a digital account takeover), you generally have 60 days from the transmittal of the statement to report the error and avoid liability for subsequent transactions.

The Error Resolution Process

When you notify your bank of an unauthorized transaction, the institution must follow a specific "error resolution" workflow. Under Regulation E, the bank generally has 10 business days to investigate the claim.

If the bank requires more time, it may extend the investigation up to 45 days (or 90 days for new accounts or foreign transactions), but it must usually provide "provisional credit" to your account for the amount in dispute while the investigation continues. If the bank determines that no error occurred, it must provide a written explanation and may revoke any provisional credit previously issued.

What Does Not Control the Issue

Several entities and laws are frequently confused with U.S. EFTA rights:

• European Free Trade Association: Despite sharing the acronym EFTA, this is a geopolitical organization in Europe and has no jurisdiction over U.S. banking transactions.
• Colombia's "Derecho de Reversión": While consumoteca.com.co covers Colombian consumer topics, the EFTA is a U.S. federal law. Colombian Decree 587 of 2016 does not apply to U.S.-based bank accounts or EFTA disputes.
• Merchant Refund Policies: A merchant's refusal to accept a return is a separate issue from an "unauthorized" transaction. An unauthorized transaction is one initiated by someone other than the consumer without actual authority to initiate the transfer.

Practical Steps for Consumers

If you identify an unauthorized transaction on your debit card or bank statement, take the following steps immediately:

1. Notify the Bank: Call the financial institution immediately to stop further unauthorized activity. Follow up with a written notice via certified mail to ensure you have proof of the date you reported the error.
2. Review Statements: Check previous months to ensure the fraud did not begin earlier than you initially thought.
3. Gather Evidence: Keep a log of your phone calls, including the date, time, and the name of the representative you spoke with. Save copies of your bank statements with the disputed charges highlighted.
4. Monitor for Provisional Credit: If the investigation lasts longer than 10 business days, verify that the bank has credited the disputed amount back to your account pending the final result.
5. Escalate if Necessary: If the bank fails to investigate or follow the timelines required by Regulation E, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) or the Office of the Comptroller of the Currency (OCC) for national banks.

FAQ

Does the EFTA protect me if I am scammed into sending money? Current guidance from the CFPB clarifies that an "unauthorized" transfer includes those initiated by a person who obtained the consumer's account information through fraud or robbery. However, if you "authorized" a transfer to a scammer yourself (e.g., via a P2P app), the bank may argue the transaction was authorized, though this remains a highly contested area of consumer law in 2026.

What if my bank's "Zero Liability" policy says I pay nothing? Private network policies often provide better protection than the law (capping liability at $0 instead of $50). However, these policies often have exceptions for "gross negligence" or delayed reporting. If the bank denies a claim under their private policy, you still retain your baseline rights under the EFTA.

How long does the bank have to put the money back? If the bank determines an error occurred, it must correct the error within one business day of that determination. If they need more than 10 business days to investigate, they must generally provide provisional credit while they finish the process.