Debit Card Fraud Liability: How Much Are You Stuck With?

Someone drains your debit card. You report it — but late. How much of the loss is yours? For US debit cards, the answer is not a single number. It is a set of tiers in Regulation E, 12 CFR 1005.6, and the tier that prices your loss depends on two clocks running from two different starting points: the day you learned the card was lost or stolen, and the day your bank sent the statement that first showed an unauthorized transfer. Report inside 2 business days and your maximum is $50. Report later but inside the 60-day statement window and it rises to $500. Report after that window closes and the transfers taken after the window are added with no cap at all.

A note on sources: every figure below was verified against the eCFR text of 12 CFR 1005.6 and 1005.11, the CFPB's official interpretation of 1005.6, and Visa's Zero Liability Policy page on October 27, 2026. Where the regulation leaves a judgment to the bank — most importantly, whether later transfers would have happened had you reported in time — this guide says so, because that judgment is where real cases are won and lost.

Try your own dates first: Debit Card Fraud Liability Calculator — three dates and four amounts, and it returns your maximum band plus your provisional-credit date.

The two clocks: 2 business days and 60 statement days

The first clock starts when you learn of the loss or theft of the access device — the card itself, or any code or device used to access the account. You have 2 business days from that day to notify the bank and stay in the cheapest tier. Business days here follow the bank's own calendar — days it is open to the public for substantially all business functions — so in practice weekdays, with bank holidays shifting a deadline by a day. Count carefully: learn of the theft on a Friday and the weekend does not count against you, but Monday and Tuesday do.

The second clock starts when the bank transmits the periodic statement that first shows an unauthorized transfer. You have 60 calendar days from that transmittal to report the transfer and avoid liability for what comes after. Note the asymmetry that trips people up: the 60 days run from the statement date, not from the transfer date and not from the day you noticed the charge. A transfer you overlooked on a statement for two months can already be near the edge of this window before you ever look at it.

The two clocks are independent, and the regulation prices them independently: the 2-day clock caps what you owe for transfers before notice; the 60-day clock decides whether transfers after the window are yours at all.

The three tiers, with worked examples

Tier 1 — reported within 2 business days: the lesser of $50 or the transfers before notice (1005.6(b)(1))

You learn on Monday that your card is gone and report on Wednesday. $200 was taken before your call. Your maximum liability is $50 — the lesser of $50 and $200. If only $30 had been taken, your maximum would be $30. Transfers after your report are not in this calculation at all.

Tier 2 — reported after 2 business days but inside the 60-day window: the lesser of $500 (1005.6(b)(2))

You learn on Monday and report the following Monday — 5 business days later. $40 was taken in the first 2 business days and $300 after that, all before you reported. Your maximum is $340: the $40 (capped at $50) plus the $300. If the later transfers had been $600, the cap would bite and your maximum would be $500. There is a condition on the later-transfers half that matters: the bank must establish those transfers would not have occurred had you notified it within the 2-day period. If it cannot, that half does not count against you — ask, in writing, how the bank established it.

Tier 3 — reported after the 60-day statement window: tier 2 plus uncapped post-window transfers (1005.6(b)(3))

Your statement showing the first unauthorized transfer was sent on September 1, so the window closed on October 31. You report on November 5. Before the window closed, $240 of transfers fell under tier 2; after October 31 and before your report, another $900 was taken. Your maximum is $1,140: the $240 tier-2 portion plus the full $900, with no cap on the second part. Again the bank must establish the post-window transfers would not have occurred had you reported inside the window — the same question, now with far more money riding on it.

Two softenings apply across all three tiers. If your delay was due to extenuating circumstances — the regulation gives extended travel and hospitalization as examples — the bank must extend the notification times to a reasonable period (1005.6(b)(4)). And if state law or your account agreement imposes less liability than the regulation, the lower figure governs (1005.6(b)(6)). Neither applies itself: both have to be raised, in writing, with dates and any proof you hold.

When no card was involved: a different branch

Not every unauthorized debit involves a lost or stolen card. Money can leave an account by an unauthorized electronic transfer made without any access device — a debit you never authorized and that used no card of yours. The CFPB's official interpretation of 1005.6 states plainly that the first two tiers do not apply to such transfers at all. Instead, only one question matters: did you report within 60 days of the statement's transmittal? If yes, your liability under these tiers is $0. If no, you may be liable for the transfers that occurred after the close of the 60 days and before notice — and only those. The calculator asks whether a card or device was involved precisely because it changes the branch, not just the number.

One boundary to be honest about: a transfer you were tricked into authorizing yourself — a scam where you sent the money — is generally not an "unauthorized" transfer under this regulation at all, and sits outside these tiers. The distinction between "taken without my permission" and "talked into sending it" is the single most common reason a Reg E claim fails, and no tier calculation fixes it.

After you report: provisional credit and the investigation

Reporting starts the bank's clock under 12 CFR 1005.11, and it is tighter than most people expect. The bank has 10 business days to investigate and resolve the error. If it cannot finish in that time, it must provisionally credit the disputed amount within 10 business days, tell you the amount and date within 2 business days after crediting, and give you full use of those funds during the investigation, completing it within 45 days of your notice. The bank may withhold up to $50 from a provisional credit where it has a reasonable basis to believe an unauthorized transfer occurred — a small haircut, not a refusal.

Three situations stretch the investigation to 90 days: the transfer was not initiated within a state, it resulted from a point-of-sale debit card transaction, or it occurred within 30 days after the first deposit to the account. That last case also stretches the provisional-credit deadline from 10 to 20 business days. Point-of-sale debit purchases are the most common reason for the 90-day window, since those investigations need merchant and network records.

One exception deserves emphasis because it is entirely avoidable: if the bank requires written confirmation of an oral error notice and does not receive it within 10 business days, it need not provisionally credit your account at all. A phone report alone can leave you waiting without the money while the investigation runs. Follow every call with a written notice, and keep the proof you sent it.

The Visa and Mastercard zero-liability caveat

Network policy sits on top of the statute and can beat it — sometimes. Visa's Zero Liability Policy requires issuers to replace funds taken from an account as the result of an unauthorized Visa debit transaction within 5 business days of notification. Mastercard operates a similar zero-liability protection for branded cards. If your card is covered, your practical liability may be $0 even where the Reg E tiers would allow $50 or $500.

But treat it as a caveat, not a guarantee. Visa states the replacement funds are provisional and may be withheld, delayed, limited or rescinded for gross negligence or fraud, delay in reporting unauthorized use, investigation and verification of a claim, or account standing and history. The policy does not apply to certain commercial card and anonymous prepaid card transactions or transactions not processed by Visa, and cardholders must use care in protecting the card and notify the issuer immediately of any unauthorized use. The right move is to ask your issuer, in writing, whether zero liability applies to your card and your facts — and to keep the Reg E calculation as your floor, because the statute is what you can rely on if the network policy does not cover you.

What to write to your bank

• The three dates, exactly: when you learned of the loss or theft, when you reported, and the statement date that first showed an unauthorized transfer. Your tier turns on these dates, so state them rather than narrating around them.
• The amounts by window: what was taken within the first 2 business days, what was taken later but before notice, and what was taken after the 60-day window if you reported late. Windowed amounts make the bank's tier calculation checkable.
• The establishment question: for any post-2-day or post-60-day amount the bank charges you with, ask how it established those transfers would not have occurred had you reported in time. That is the bank's burden under the regulation, not yours.
• Any extenuating circumstances: travel, hospitalization, or anything else that delayed you, with dates and proof. The regulation requires an extension to a reasonable period where delay was due to such circumstances.
• Zero liability, if branded: ask whether Visa or Mastercard zero liability applies to your card, and get the answer in writing alongside the Reg E decision.
• Keep everything: the report reference number, every response, the provisional-credit date, and the investigation deadline. If the bank misses its 10-business-day provisional-credit date or its 45- or 90-day investigation deadline, that miss is itself something to raise in writing.

Sources (verified October 27, 2026): 12 CFR 1005.6, Liability of consumer for unauthorized transfers (eCFR text) — tiers (b)(1), (b)(2), (b)(3), extenuating circumstances (b)(4), notice (b)(5), state law or agreement (b)(6); 12 CFR 1005.11, Procedures for resolving errors (eCFR text) — 10-business-day investigation, provisional credit, 45-day completion, 20-business-day and 90-day extensions (c)(3), written-confirmation exception (c)(2)(i)(A); CFPB Official Interpretation, comment 6(b)(3)-2 — first two tiers do not apply to transfers without an access device; Visa Zero Liability Policy (visa.com) — 5-business-day fund replacement, provisional nature, gross-negligence and delay exclusions, commercial and anonymous-prepaid exclusions.

Frequently asked

Related reading

• Debit Card Fraud Liability Calculator — run your own dates through the tiers.
• Debit Card Dispute Time Limits — the broader debit dispute clock.
• After the 60-Day Window — what happens when the statement window has closed.
• The Authorized-Debit Reg E Gap — why transfers you were tricked into authorizing sit outside these tiers.
• Chargeback Deadline Calculator — the card-dispute clock behind any debit claim.
• How Long Does a Chargeback Take? — the general timeline behind the clocks in this guide

Open the liability calculator