Unauthorized Debit Card Transactions: Reporting Deadlines and Provisional Credit

Separate unauthorized use from a disputed authorized purchase

Regulation E defines unauthorized electronic fund transfers according to whether a person initiated the transfer without actual authority and without the consumer receiving a benefit, subject to exceptions. A stolen-card ATM withdrawal or a third party's unauthorized debit purchase can qualify. A purchase you personally authorized but later regretted, or a merchant's contractual dispute over product quality, does not automatically become unauthorized EFT fraud. A compromised online banking credential can trigger similar consumer EFT protections even without a missing physical card.

Write what actually occurred before selecting a bank dispute category. Did someone steal the card, obtain the number, persuade you to send money yourself, or overcharge an authorized amount? Those facts affect liability and procedures. If you recognize the merchant but disagree with the total, check receipts and pending-versus-posted amounts. A card-network chargeback may offer a contractual mechanism for some merchant disputes, but it should not be conflated with federal Regulation E error rights. Tell the bank promptly when a transaction was not authorized, even if you are still determining the full scope of the compromise.

Apply the lost-card two-business-day rule correctly

If a consumer learns that an accepted debit card or other access device was lost or stolen, reporting within two business days generally limits liability for unauthorized EFTs made before notice to the lesser of $50 or the actual amount transferred, assuming the regulation's conditions are met. Reporting later can raise potential liability up to $500 under a formula that considers when transactions occurred and whether timely notice could have prevented them. The amount is not automatically a flat $500 penalty; the institution must satisfy the applicable statutory conditions.

Suppose a card disappears Monday and the customer learns of the loss that afternoon. A $120 unauthorized withdrawal occurs Tuesday, but the consumer tells the bank by the second business day. Potential Regulation E liability would generally be no more than $50, and a bank's own policy may provide more favorable protection. If the customer waits longer, losses after the protected period can matter. Business days are defined under the relevant regulation and the institution's operating schedule, not simply by assuming every weekend is excluded. Report through the bank's designated fraud channel and preserve a case number even when no suspicious charge has yet posted.

Do not confuse the 60-day statement deadline

A separate rule addresses unauthorized EFTs that appear on a periodic statement. A consumer generally should notify the bank within 60 days after the statement was transmitted; failing to do so may expose the consumer to liability for additional unauthorized transfers after that period that the bank could have prevented if informed. The 60-day statement rule does not simply erase all protection for every transaction that happened earlier. Similarly, the two-business-day lost-card tiers do not necessarily govern a transfer performed without an access device.

For example, if a stolen credential triggers recurring withdrawals and a statement lists the first one, a customer should report that first event rather than wait until a later withdrawal proves a pattern. Note the statement transmission date rather than guessing from the printed payment due date. Some circumstances justify extensions, such as a qualifying hospitalization, and state law or issuer agreements may be more protective. If a bank says a claim is late, ask which clock it used and how it applied the underlying liability provision. A precise timeline can reveal whether the bank assessed the wrong category of notice.

Track investigation, provisional credit and final findings

Under Regulation E section 1005.11, banks generally must investigate a covered error promptly and determine the result within 10 business days, subject to specified exceptions. If an investigation requires longer, a bank may generally take up to 45 days if it timely provisionally credits the alleged error and meets other requirements; certain cases have different 20-business-day or 90-day periods. Provisional credit is not always unconditional, and an institution may require written confirmation after oral notice in circumstances specified by the rule. Do not treat a temporary credit as a final admission that the claim is valid.

If $680 was debited, monitor whether the bank grants a temporary credit, whether the credit is spendable and whether any corresponding fees or interest were corrected. Keep rent money separate from provisional funds if the bank has warned of a potential reversal. A bank that finds an error must correct it within the applicable deadline and communicate the result. If the bank decides the transfer was authorized, request the explanation and supporting documents available under the rule. Screenshots of merchant descriptors and an incident timeline are often more useful than repeating that the transaction 'looks fraudulent.'

Prevent repeat losses and challenge an inadequate denial

Freeze or replace the compromised card, secure online credentials, review connected wallets and check for newly added payees. Monitor the account for several statements because attackers may test small transactions before a larger withdrawal. Ask about separate recurring-token or merchant credentials that could continue billing a newly issued card. Change compromised email passwords as well, especially if password-reset messages were exposed. Notify the bank if more unauthorized transfers appear; do not assume the first claim automatically includes later transactions.

If the bank closes a claim without addressing key evidence, ask for the exact factual basis and investigation results. Identify the disputed transaction, legal reason you believe it was unauthorized, date of notice and any errors in the bank's chronology. A CFPB or regulator complaint can supplement the direct dispute, but it should not replace it. Continue to safeguard future deposits and scheduled bills. The practical goal is both a corrected past loss and a secured account that cannot be quietly drained again. After the first report, obtain the bank's case number and confirm whether it blocked the compromised card, token and recurring merchant credentials. Replacing plastic without addressing an exposed online account password can leave another route for attempted unauthorized payments.

Editorial Verdict

Debit-card fraud combines immediate cash-flow damage with deadlines that are easy to misread. For an accepted lost or stolen access device, the two-business-day report can cap liability at $50, while later notice may increase exposure; the 60-day statement rule addresses an additional risk. Regulation E's investigation and provisional-credit deadlines are separate again. Report promptly, obtain the case number and preserve account statements, not merely a verbal promise of reimbursement. If the bank denies the dispute, request its reasoning and verify which legal category it applied. A strong result is not only refunded money but also removal of compromised access and a reliable future transaction record.

Frequently Asked Questions

Is every unauthorized debit-card payment protected by a zero-liability federal rule?

No. Regulation E contains conditional liability tiers, although bank or card-network policies may offer stronger protection.

Does the bank always have to complete a debit-card fraud investigation in 10 days?

Not always. The regulation permits longer investigations in specified circumstances, generally with provisional-credit and other requirements.

Do the two-business-day and 60-day clocks start at the same time?

No. They concern different events: learning of access-device loss or theft and transmission of a statement showing an unauthorized transfer.

Sources

• CFPB — Regulation E liability section 1005.6
• CFPB — Regulation E investigations section 1005.11
• CFPB — official interpretation of liability tiers