Did an unauthorized charge just appear on your account statement? The cash you lose depends heavily on which card you pulled out of your wallet. Credit cards give you plenty of breathing room to dispute charges, while debit cards force you to act almost immediately to protect your savings. Wait too long, and you eat the loss.
Federal laws protect both, but their dispute clocks run differently.
Federal Dispute Deadlines at a Glance
Federal statutes set hard limits on what a bank can legally force you to pay. Here is how the numbers stack up:
| Payment Rail | Primary Law | Reporting Deadline | Consumer Liability Cap |
|---|---|---|---|
| Credit Card | Fair Credit Billing Act | 60 calendar days from statement | $50 ($0 under card network rules) |
| Debit Card (lost physical card) | Regulation E | 2 business days from discovery | $50 |
| Debit Card (late report of lost card) | Regulation E | 3 to 60 calendar days after statement | $500 |
| Debit Card (stolen number only) | Regulation E | 60 calendar days from statement | $0 for charges within 60 days |
| Debit Card (past statement window) | Regulation E | Past 60 calendar days from statement | Unlimited for subsequent transfers |
Credit Card Rules Under the Fair Credit Billing Act
Credit cards provide the strongest safety net in consumer banking. Under Regulation Z billing error rules, your out-of-pocket exposure for unauthorized charges cannot exceed $50 under federal law. Major payment networks like Visa and Mastercard routinely drop that statutory liability down to zero for cardholders in good standing.
Thing is, that 60-day legal clock starts on the date the issuer mails or electronically transmits your billing statement, not the afternoon a stranger swipes your card number. Miss that transmission date because an electronic statement sat buried in your junk folder, and you burn through your entire statutory dispute window without ever realizing the theft happened. Open every statement immediately.
Once you submit a written dispute, the card issuer has 30 days to acknowledge it. They get two billing cycles, capped at 90 days, to finish.
Debit Cards and Bank Transfers Under Regulation E
Debit cards pull funds straight from your checking balance. Because actual cash leaves your bank right away, 12 CFR 1005.6 consumer liability rules set much stricter reporting thresholds. The exact deadline depends on whether you lost the physical plastic.
- Reported within 2 business days of learning of the loss: Your liability caps at $50.
- Reported after 2 business days but within 60 calendar days: You risk losing up to $500.
- Reported past 60 calendar days after statement transmittal: You face unlimited liability for any unauthorized transfers occurring after that 60-day window closes.
When a thief clones your number online while the physical card never leaves your wallet, the two-day trap does not apply, which is a massive relief if you do not spot the charge right away. You get 60 calendar days from the statement date to flag the fraud with zero liability. The bank normally has 10 business days to investigate under 12 CFR Part 1005. If they take up to 45 days, they must issue provisional credit to restore your cash balance while they review the claim. That provisional credit puts real money back into your checking account, though the bank will snatch it right back if they determine the charge was legitimate. Check your balance regularly.
Peer-to-Peer Apps and Scam Transfers
Peer-to-peer services like Zelle, Venmo, and PayPal create confusing legal territory for victims. If a thief hacks your credentials or swipes an unlocked phone to send funds, Regulation E treats that activity as an unauthorized transfer. The bank must investigate under standard error-resolution rules. Standard liability caps still apply here.
Trickery changes the legal outcome entirely. If an imposter posing as your bank's fraud department convinces you to send money yourself, federal regulations classify that payment as authorized. You pressed the confirmation button. Because you initiated the transaction, banks almost always reject refund requests on the spot. Commercial purchases on select apps might include buyer protection, but personal peer-to-peer transfers offer virtually no statutory safety net.
Step-by-Step Dispute Process
Turns out, a phone call does not legally preserve your rights. Follow this sequence to protect your claim:
- Freeze the card and call your bank. Use the telephone number on the back of your card. Lock the card inside your banking app first to prevent follow-up charges.
- Send a formal billing error notice by mail. Phoning customer service starts an informal review, but written notice preserves your legal protections under the Fair Credit Billing Act. Mail your letter to the specific billing inquiries address on your statement, never the regular payment address.
- Log every single interaction. Note the date, exact time, agent name, and case reference number for each phone call. Keep copies of every letter, screenshot, and email confirmation.
- File an official identity theft report. If an intruder compromised your account logins or Social Security number, lodge a report at IdentityTheft.gov. That formal federal affidavit carries real weight when an institution pushes back on an unauthorized charge.
What Happens If You Miss the Deadline?
Missing the 60-day statutory dispute window destroys your legal leverage.
Banks have no legal obligation to reimburse you once that federal clock runs out, although certain card issuers occasionally waive losses under internal customer courtesy rules. If your financial institution misses its mandatory investigation deadlines or outright refuses to honor a timely claim, submit a complaint directly through the Consumer Financial Protection Bureau website. Open your banking app and audit your recent transactions right now.