Your losses from a stolen debit card can depend on something you might not expect: how fast you tell your bank. Federal rules set the limits, and the deadlines are short. Here is how the system works, what your bank has to provide, and what to write down so you can count the days yourself.
What Regulation E covers
Regulation E is a federal rule that carries out the Electronic Fund Transfer Act. An electronic fund transfer, or EFT, is any movement of money started electronically, such as a debit card purchase, an ATM withdrawal, or a transfer from your account through an app. The rule is written at 12 CFR 1005.6, and the Consumer Financial Protection Bureau (CFPB) publishes the text on its website. It sets how much of an unauthorized transfer you can be held responsible for.
The rule uses three tiers: $50, $500, or unlimited. Which one applies depends mostly on when you notify your bank. The protections only cover transfers you did not authorize. If you handed your card to a family member and they spent it, that is generally not an unauthorized transfer. If someone got the card through fraud, robbery, or force, the official interpretation treats the transfer as unauthorized.
One more detail matters. The CFPB reaffirmed in 2021 that the limits apply when you give timely notice and the bank finds that an unauthorized transfer happened. In other words, your report starts the process, but the bank's finding is what turns on the protection.
The two-business-day rule and the 60-day rule
The first tier is the most generous. If you report a lost or stolen card within two business days after you learn about the loss or theft, your liability is the lesser of $50 or the unauthorized transfers made before you gave notice. A business day generally means a day the bank is open for most of its services, and your bank's disclosures should define its own business days.
The second tier applies when you miss that window. Your liability can rise to as much as $500. The formula counts up to $50 for transfers in the first two days, plus later unauthorized transfers that the bank can show would not have happened if you had reported on time. The cap is the lesser of $500 or that total.
The third tier is about periodic statements, the monthly or regular account summaries your bank sends. If an unauthorized transfer appears on a statement, you generally need to report it within 60 days after the bank sent that statement. If you miss the 60 days, you can be liable for later unauthorized transfers, but only where the bank shows those transfers would not have happened had you reported in time.
The 60-day clock starts when the statement is sent, not when the transfer happened. The sources use an example of a January 1, 2024 transfer on the January statement, with a deadline about 60 days after that statement went out, around April 1, 2024. The exact date depends on when the statement was transmitted, so check the statement itself and your bank's records.
What the bank has to give you first
Before a bank can hold you liable at all, it has to have given you certain disclosures under 1005.7(b). These include a summary of liability rules for unauthorized transactions, the phone number and address for reporting an unauthorized EFT, and the bank's business days. If those disclosures were never provided, the bank may not be able to impose liability on you. That is a question worth asking directly.
The card or code involved also has to be an "accepted access device." In plain terms, that means you requested and received the card, signed it, or used it to move or get money. A device can also count as accepted if you asked for it to be validated, or if you received a renewal or replacement from the bank. The bank also needs a way to confirm which customer the device was issued to.
Once you report a problem, the bank must investigate promptly and decide whether the transaction was an unauthorized EFT. Limited liability depends on that finding. The sources note that digital fraud and disputed transfer reports were rising when the CFPB issued its 2021 guidance. One bank's consumer page also says debit card fraud is among the most common scams banks see, and it warns that the 60-day rule can leave people exposed. That warning is a good reason to read your statements closely.
Checkpoints to write down
You do not need special software to track your deadlines. A notebook or a note on your phone works. Start by recording the date you first learned your card was lost or stolen. That date decides whether the two-business-day window was met. Then record the date each periodic statement was sent, and the date you noticed any transfer you did not make.
Keep a copy of any disclosures your bank gave you, especially the liability summary and the reporting phone number and address. If you cannot find them, ask for them in writing. When you call to report a problem, note the date and time, the name of the representative, and any reference number. Those details help you prove when you gave notice.
- The date you learned the card was lost or stolen
- The date each statement showing a questionable transfer was sent
- Whether the bank gave you its liability summary and reporting contact information
- The date and time you reported, and any reference number
What these sources leave out
The sources do not say how long a bank has to finish an investigation. They also do not explain when provisional credit, which is temporary money put back into your account during a review, is issued, or what happens to disputed funds while the review runs. A companion article on error resolution is mentioned but was not included, so those answers are not covered here.
The sources also leave out state laws, which may add protections beyond the federal floor. They do not explain how debit card rules differ from credit card rules. Some official pages, including the Federal Trade Commission's guidance on lost or stolen cards, returned mostly navigation or access blocks when reviewed, so the full regulatory text and commentary should be checked directly. The CFPB's version of 12 CFR 1005.6 and the FTC's consumer advice on lost or stolen cards are good places to start. For your own situation, a qualified professional can review the details.
Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.
