How much of a stolen-debit-card loss are you stuck with if you reported late? Under US Regulation E, the answer depends on two clocks: how many business days passed between learning of the loss or theft and reporting it, and whether you reported within 60 days of the statement that first showed an unauthorized transfer. 12 CFR 1005.6 caps liability at $50 if you reported within 2 business days, at $500 if you reported later but inside the statement window, and leaves transfers after the 60-day window uncapped. Enter your three dates and the amounts taken in each window, and this calculator works out your maximum liability band, your provisional-credit date, and what to do next.
Framework checked October 27, 2026 — every figure below is taken from the primary sources named on this page: the eCFR text of 12 CFR 1005.6 and 1005.11, the CFPB's official interpretation of 1005.6, and Visa's Zero Liability Policy page. Results are the maximum the regulation allows, not a promise of what your bank will charge. This calculator asks for no card number, PIN or account number — never enter those anywhere to check liability.
Your debit card fraud liability — three dates, four amounts
Everything is counted in your browser and never sent anywhere. Amounts are split by when the money was taken, because the regulation prices each window differently. Leave an amount blank if nothing was taken in that window.
The day you realized the card was lost or stolen — not the day the first unauthorized transfer happened. The 2-business-day clock runs from here.
The day you told your bank, by phone, in person, or in writing. Transfers after this date are not counted in these tiers.
The date your bank sent (transmitted) that periodic statement. The 60-day window runs from this date, not from the transfer date.
Only fill this in if you reported after the 60-day window closed. If you reported inside the window, leave it blank — those transfers belong in the box above.
Shown for completeness only — transfers after you reported are not counted in these liability tiers.
Advertisement
The rules underneath
The liability tiers, in one view
Regulation E does not give one number for debit card fraud. It gives three tiers, and which one prices your loss depends on when you reported, measured against two different starting points. The first two tiers are about the card itself; the third is about the statement:
When you reported
Your maximum liability
Within 2 business days of learning the card was lost or stolen
The lesser of $50 or the transfers before notice. 12 CFR 1005.6(b)(1). If only $30 was taken before you reported, your maximum is $30.
After 2 business days, but within 60 days of the statement
The lesser of $500 or the sum of: $50 (or the transfers within the 2 business days, whichever is less) plus transfers after the 2 business days and before notice. 12 CFR 1005.6(b)(2). The bank must establish the later transfers would not have occurred had you reported in time.
After 60 days from the statement's transmittal
The tier 1 or tier 2 amount, plus — with no cap — the transfers after the close of the 60 days and before notice. 12 CFR 1005.6(b)(3). That uncapped addition is why late reporting after the statement window is the expensive mistake.
No card or device involved, reported within 60 days of the statement
$0 under these tiers. The CFPB's official interpretation of 1005.6 states the first two tiers do not apply to transfers made without an access device; only transfers after the 60-day window are at risk if the report comes late.
Two more rules soften the tiers. If your delay was due to extenuating circumstances — the regulation names extended travel and hospitalization as examples — the bank must extend the notification times to a reasonable period (1005.6(b)(4)). And if state law or your account agreement imposes less liability than the regulation, the lower figure governs (1005.6(b)(6)). Both are worth raising in writing, because neither applies itself automatically.
What happens after you report: provisional credit
Reporting starts the bank's clock, not just yours. Under 12 CFR 1005.11, the bank has 10 business days to investigate; if it cannot finish in that time, it must provisionally credit the disputed amount within 10 business days and give you full use of those funds while it investigates, completing the investigation within 45 days. The windows stretch for three kinds of transfer: if the transfer happened within 30 days after the first deposit to the account, provisional credit moves to 20 business days and the investigation to 90 days; if the transfer was a point-of-sale debit purchase or was not initiated within a state, the investigation moves to 90 days. The bank may withhold up to $50 from a provisional credit where it has a reasonable basis to believe an unauthorized transfer occurred — and it need not provisionally credit at all if it requires written confirmation of an oral error notice and does not receive it within 10 business days. That last exception is why the calculator tells you to follow a phone report up in writing.
Want the full story, with the statute citations?
The companion article works through each tier with worked examples, the no-device branch, the provisional-credit timeline, the Visa and Mastercard zero-liability caveat, and what to write to your bank — each claim tied to its primary source. Read it here: Debit card fraud liability: how much are you stuck with?.
The lesser of $50 or the amount taken before you reported, under 12 CFR 1005.6(b)(1). If $30 was taken before your call, your maximum is $30; if $500 was taken, your maximum is $50. And if your card is a branded Visa or Mastercard, ask your issuer about zero liability — network policy may reduce it to $0, subject to the issuer's conditions.
Not everything — only up to $500 for transfers before notice, under 12 CFR 1005.6(b)(2), provided you reported within 60 days of the statement that showed the unauthorized transfer. The expensive jump comes only after that 60-day window closes: transfers after the window and before notice are added with no cap under 1005.6(b)(3).
Regulation E ties a business day to the institution's own calendar — days it is open to the public for substantially all business functions. This calculator counts weekdays (Monday to Friday) and skips weekends; a bank holiday may shift a deadline by a day, so confirm the exact date against your bank's calendar. The 60-day statement window, by contrast, is calendar days.
Not automatically. Visa requires issuers to replace funds from an unauthorized Visa debit transaction within 5 business days of notification, but replacement funds are provisional and may be withheld, delayed, limited or rescinded for gross negligence or fraud, delay in reporting, investigation and verification, or account standing and history. The policy does not cover certain commercial card and anonymous prepaid card transactions or transactions not processed by Visa. Ask your issuer whether your card is covered — network policy is a caveat on top of the statute, not a replacement for it.
Sources (checked October 27, 2026): 12 CFR 1005.6, Liability of consumer for unauthorized transfers (eCFR text) — tiers (b)(1), (b)(2), (b)(3), extenuating circumstances (b)(4), notice (b)(5), state law or agreement (b)(6); 12 CFR 1005.11, Procedures for resolving errors (eCFR text) — 10-business-day investigation, provisional credit, 45-day completion, 20-business-day and 90-day extensions (c)(3); CFPB Official Interpretation, comment 6(b)(3)-2 — first two tiers do not apply to transfers without an access device; Visa Zero Liability Policy (visa.com) — 5-business-day fund replacement, provisional nature, gross-negligence and delay exclusions, commercial and anonymous-prepaid exclusions.
General information only — not legal or financial advice. Whether a transfer counts as unauthorized, and what your bank charges, depends on your bank's investigation of your specific case, which no calculator can see. This calculator applies the published regulation to the dates and amounts you gave it, counting business days as weekdays. Never enter a card number, PIN or account number into any liability calculator — no genuine check needs them.
Chargeback Clock