Unauthorized transaction rules follow the payment rail, not the wording on your statement. A debit card charge, an ATM withdrawal, an ACH pull, and many prepaid transfers sit under Regulation E. Credit card charges go through the Fair Credit Billing Act plus card network policy. Wires and some P2P payments give you less room. Move fast. Put notice in writing when possible, and save proof of when you contacted your bank.
Start With the Payment Rail
Two charges can look identical in your app. The rule that controls them may not match. Use the rail to pick your deadline, liability cap, and complaint path.
| Payment type | Main rule | First deadline | Liability risk |
|---|---|---|---|
| Debit card, ATM, ACH, prepaid (consumer EFT) | Regulation E, 12 CFR Part 1005 | 2 business days for lost or stolen access device; 60 days from statement for error notice | Up to $50 if you report a lost/stolen device within 2 business days; up to $500 if later but within 60 days; later transfers can be your loss after 60 days |
| Credit card | Fair Credit Billing Act and card network policy | Written billing dispute within 60 days of statement | FCBA caps unauthorized liability at $50; network zero-liability often lowers it to $0 |
| Wire transfer | UCC Article 4A and bank recall process | Contact bank immediately, often within 24-48 hours | No federal zero-liability rule like Regulation E |
| P2P or app transfer | Depends on authorization and account type | Report unauthorized access immediately | Hack may qualify as Reg E error; scam you approved is often treated as authorized |
That table is your first filter. If the money moved as a consumer electronic transfer, you're likely in Regulation E territory. If it moved on a credit line, FCBA usually controls the billing dispute.
Regulation E: Debit, ACH, and Prepaid Transfers
Regulation E is the federal error-resolution rule for consumer electronic fund transfers. It covers debit card purchases, ATM withdrawals, ACH debits, and many prepaid account transactions. The CFPB rule text at Section 1005.6 sets liability tiers. Section 1005.11 sets investigation duties.
Turns out, the $50 and $500 caps apply to a lost or stolen access device, not to every unauthorized transfer, and that difference trips up a lot of people because a stolen account number and a stolen card are not the same event even if the money leaves your account the same way. If someone stole only your account number, without your card, the 60-day notice rule still matters. Your liability math can differ.
Report within two business days of learning your card is missing, and your max is usually $50. Wait longer but report within 60 days of the statement that shows the transfer, and the cap can rise to $500. After that, the bank can hold you responsible for transfers it proves it could have stopped if you had called.
Once you report an error, the bank usually has 10 business days to investigate or provisionally credit you. Some cases take longer, often up to 45 calendar days. New-account, point-of-sale debit, or foreign-initiated transactions can run longer. Ask for provisional credit in writing. Note the date.
Credit Cards: FCBA, Not FCRA
Credit card billing disputes run under the Fair Credit Billing Act, not the Fair Credit Reporting Act. The names are close, and people mix them up. FCRA handles credit reports and identity-theft blocks. FCBA handles billing errors on your card statement.
To keep your rights, send a written dispute to the address your issuer lists for billing inquiries. Do it within 60 days of the statement showing the problem. The issuer must acknowledge within 30 days. It must resolve within two billing cycles or 90 days, whichever is shorter. Under FCBA, unauthorized charge liability is capped at $50. Most major card networks promise zero liability as policy. That policy is often better than the law, but it depends on your cardholder agreement and the issuer's fraud review. See Investopedia's FCBA explainer for basics.
What Doesn't Count as Unauthorized
Not every surprise charge is fraud. If you gave a family member your card, forgot to cancel a subscription, or a merchant charged the wrong amount, that's usually a billing dispute or refund issue. If a scammer talked you into sending money, many banks treat the payment as authorized. Thing is, that distinction matters. Authorized-but-regretted payments often fall outside Regulation E fraud protections.
How to Dispute an Unauthorized Transaction
- Lock the card or account in your bank app. That stops more losses.
- Call the bank's fraud line, then send written notice. Regulation E allows oral notice, but written notice leaves a clean record. For credit cards, FCBA requires a written billing dispute.
- Save the statement, transaction date, amount, merchant name, confirmation numbers, and any chat or email.
- Ask for provisional credit and a case number. Under Regulation E, the bank generally must provisionally credit within 10 business days if it cannot finish in that time.
- Check your credit reports if identity theft is possible. Place a fraud alert or security freeze under FCRA.
- Escalate if the bank misses deadlines or denies the claim without a valid reason. The CFPB takes complaints. The OCC or FDIC may oversee certain banks. State attorneys general can also help.
- Follow up every 7 to 10 days. Get denial reasons in writing.
When the Bank Denies Your Claim
Denials are not always final, to be honest. Banks sometimes reverse a denial after a formal review, especially when you provide new evidence. Request the specific reason in writing. Appeal through the bank's internal process. If that fails, file with the CFPB or the right regulator. For large losses or repeated violations, a consumer law attorney may be worth a consultation. This is not legal advice.
Deadlines to Put on Your Calendar
Two business days. Sixty days from the statement. Ten business days for provisional credit. Thirty days for a credit card issuer to acknowledge. Ninety days or two billing cycles for a final answer. Those dates decide who eats the loss.
If You're Outside the U.S.
Rules differ by country. EU payment rules under PSD2 and UK rules under the Payment Services Regulations give consumers different refund and authentication rights. Don't mix those timelines with U.S. Regulation E or FCBA deadlines. Use the law of the country where your account is held.
FAQ
What is the 60-day rule for unauthorized transactions?
For debit, ACH, and prepaid transfers under Regulation E, the key deadline is 60 days after the bank sends the statement that first shows the problem. For credit cards under FCBA, it's 60 days after the statement with the billing error. Miss it and your rights get weaker.
Is my liability really capped at $50?
Only in certain situations. For a lost or stolen debit card or access device, Regulation E caps your liability at $50 if you notify the bank within two business days of learning the device is missing. Report later but within 60 days, and the cap can rise to $500. Credit card liability under FCBA is capped at $50, but network zero-liability policies often reduce it to $0.
Does the bank have to give provisional credit?
Under Regulation E, if the bank can't finish its investigation within 10 business days, it generally must provisionally credit the disputed amount within that period. There are exceptions. It can reverse the credit if it later finds no error.
What's the difference between FCBA and FCRA?
FCBA handles credit card billing disputes and unauthorized charges on your card. FCRA handles what appears in your credit reports, including fraud alerts, identity theft blocks, and disputes over fraudulent accounts.
What if I sent money through Zelle, Venmo, or Cash App?
It depends. If someone accessed your account and sent the money without permission, treat it as a Regulation E error and report it fast. If you were tricked into sending the payment, many banks treat it as authorized. Recovery is harder. Contact the app and your bank immediately.
If the loss is large or the bank refuses to follow its error-resolution rules, a consumer law attorney can review your case. Otherwise, start with a written dispute, a case number, and a calendar reminder.