Someone used your card or opened credit in your name. Do you still have time to stop the damage?
The payment rail decides almost everything here. A stolen debit card, a credit card charge you never made, and a completed wire don't share the same federal deadline or the same chance of getting funds back. Call the financial institution first.
Then file the official reports so a bureau, a card issuer, or law enforcement has a record if they later ask for one.
Regulation E sets debit and ATM liability caps
Unauthorized consumer electronic transfers, including many debit and ATM card uses, sit under Regulation E. The CFPB Regulation E liability rule sets the consumer caps. You'll find the same text at 12 CFR 1005.6.
Notify the bank within two business days after you learn the access device was lost or stolen. Your liability then generally can't exceed the lesser of $50 or the unauthorized amount that posted before notice.
Wait past those two business days and the cap can rise. The CFPB rule then says your liability shall not exceed the lesser of $500 or the sum of unauthorized transfers described in that section.
There's a second clock. Wait more than 60 days after the statement that first showed the unauthorized transfer and you can owe later transfers the bank shows wouldn't have occurred if you'd reported in time.
Turns out Saturday may be a business day at your bank. If Saturday is a business day and Sunday isn't, the two-business-day period can begin Saturday and expire at 11:59 p.m. on the second business day.
Have dates, amounts, and the last four digits ready when you call, really just enough to identify the transfers you didn't make, and ask for a case number. Follow any written-confirmation request they make.
Credit cards are not the Regulation E ladder
Debit caps above don't automatically apply to a credit card. Unauthorized credit charges go through the issuer's billing-error channel. Call the number on the card and follow the issuer's written dispute steps as soon as the charge appears.
A completed wire is a race against settlement
Thing is, a consumer wire is often already gone by the time you notice. These transfers can move fast, and once the receiving side has the funds, the sending bank may have little practical ability to pull them back.
Call the sending bank today. Ask for a recall attempt and a written case number. File with IC3 even if the money has left.
Identity theft needs bureau alerts, not only a card dispute
New loans, tax filings, or cards in your name are a credit-file problem. The CFPB identity theft page tells you to place a fraud alert with Equifax, Experian, or TransUnion. One bureau notifies the other two. There are initial fraud alerts and extended alerts. If a deployment lasts longer than 12 months, you may place another alert.
Work this sequence:
- Place a fraud alert with one of the three nationwide bureaus.
- Get an Identity Theft Report and recovery plan through IdentityTheft.gov.
- Call every issuer that opened or touched an account.
- Keep copies of letters, and a police report if a creditor demands one.
Report the scheme after you stop the bleeding
Account disputes and crime reports aren't the same filing. For phishing, account takeovers, investment pages, and other internet-enabled theft, use the Internet Crime Complaint Center. Submit the form at IC3's complaint portal.
IC3 says it can't reply to every complaint. It still routes information through FBI field offices and law enforcement partners. Use official websites and phone numbers you look up yourself, not a callback number from the scam.
Match the incident to the clock that actually matters
Use this as a map, not a promise of a refund.
| What happened | First call | Main process | Clock that hurts |
|---|---|---|---|
| Stolen debit or ATM card | Bank or credit union | Regulation E unauthorized transfer | Two business days after you learn of loss or theft; 60 days after the statement |
| Credit card charge you didn't make | Card issuer | Issuer billing-error dispute | The longer it sits, the harder the paper trail |
| Wire you were tricked into sending | Sending bank | Recall attempt; often outside the Regulation E caps | Hours, not weeks |
| New accounts in your name | Credit bureaus and issuers | Fraud alert plus Identity Theft Report | Delay lets fake accounts age |
Willing payments and delayed notice break a lot of claims
To be honest, banks treat a transfer you approved as authorized even when a romance or investment story was fake, which means Regulation E's unauthorized-transfer caps may not apply, and people still wait because they feel foolish or they hope the charge will reverse itself, and then the two-business-day notice window on a lost debit card is gone and the 60-day statement window is sitting there unused.
Get the case number anyway. Don't assume silence is a refund.
Call the bank before you file reports
Call the bank or card issuer that holds the account before you do anything else today, and write down the time, the reference number, and the exact words they used. Then file the IC3 or identity-theft report. Do it while names, amounts, and URLs are still in front of you.