The clock that decides what a stolen debit card ends up costing does not start when the card goes missing. It starts at the moment the cardholder realizes it is gone. Federal law allows two business days from that realization, and the distance between beating that deadline and missing it is the distance between a $50 ceiling and a $500 one.
The rule is Regulation E, which implements the Electronic Fund Transfer Act and covers debit cards, ATM cards and electronic debits pulled directly out of a checking or savings account. That is a separate body of law from the credit card protections most households have in mind, and it works differently. Three distinct liability tiers sit inside one section of it.
Two business days, counted in 24-hour blocks from the moment of discovery
Under 12 CFR 1005.6(b)(1), a consumer who notifies the financial institution within two business days after learning of the loss or theft of an access device is liable for no more than the lesser of $50 or the amount of unauthorized transfers that occurred before that notice. If a thief drained $2,000 and the cardholder called the next morning, the exposure is $50. If the thief managed $30 before the call, the exposure is $30.
The counting method is stricter than most people assume, and it is spelled out in the official interpretation attached to the rule. The two-day period does not include the day the loss is discovered, and it does not include days that are not business days. It runs as two 24-hour blocks, without regard to the bank’s business hours. The regulation’s own example: a consumer who learns of the theft at 6 p.m. Friday, in a week where Saturday is a business day and Sunday is not, has until 11:59 p.m. Monday, not until the branch closes Monday afternoon.
Notice does not have to be in writing and does not have to be perfect. The rule treats notice as given when the consumer takes the steps reasonably necessary to get the information to the institution, in person, by phone or in writing, and it counts even if the consumer cannot produce an account or card number, so long as the account can otherwise be identified.
Free retirement updates: Scams move fast, but their pressure tactics leave patterns. The free Retirement Shield newsletter explains the newest warnings and the practical tell to watch. Get the free newsletter.
Missing the deadline moves the ceiling from $50 to $500
When that notice is late, the second tier applies. Liability rises to the lesser of $500 or the sum of two pieces: up to $50 of whatever was taken inside the two business days, plus everything taken after those two days and before notice, and only if the institution can establish those later transfers would not have happened had it been told in time.
The Bureau’s own worked example shows how much the sequence matters. A card is stolen Monday and the owner knows it Monday. The report is made Friday, so the $500 tier is in play. If $100 vanished Tuesday and $600 vanished Thursday, the liability is $500. Reverse the amounts, with $600 taken Tuesday and $100 Thursday, and the liability is $150. Same delay, same total loss, very different bill, because the first two business days are capped at $50 no matter how large the transfers inside them.
The 60-day statement rule is where “unlimited” comes from
The third tier is the one worth reading slowly. A consumer must report an unauthorized transfer that appears on a periodic statement within 60 days of the institution sending that statement. Miss that, and liability is not capped at all. But the uncapped amount is narrower than the phrase suggests: it reaches the unauthorized transfers that occur after the close of the 60 days and before notice is given, and only those the institution establishes would not have happened had it been told inside the window. Losses before and during the 60 days are still governed by the $50 and $500 tiers.
For transfers made without a card at all, such as an unauthorized electronic debit, the first two tiers do not apply. The regulation’s example is blunt. A $200 unauthorized debit reported within 60 days of the statement carries no liability. Add a $400 unauthorized debit on the 61st day, with the consumer not reporting the first one until the 62nd, and the consumer may be liable for the full $400.
Writing the PIN on the card cannot raise the limits, and hospitalization extends them
Two provisions cut in the consumer’s favor and are routinely misunderstood. The official interpretation of the liability limits states that negligence cannot be the basis for greater liability than Regulation E allows, and it names the exact behavior people fear will void their protection: writing the PIN on a debit card or on a slip of paper kept with it. The extent of liability turns on promptness of reporting, and no account agreement may impose more liability than the regulation permits, though a state law or agreement that imposes less controls.
The deadlines also bend. Under 1005.6(b)(4), if the delay in notifying the institution was due to extenuating circumstances, the bank must extend the time limits to a reasonable period. The interpretation gives extended travel and hospitalization as the examples, which is precisely the situation of a retiree who returns from three weeks away to a stack of statements. Notice given by someone acting on the consumer’s behalf counts as well.
After the report, the bank is on a 10-business-day clock
Reporting starts a second set of deadlines, this time running against the institution. Section 1005.11 requires the bank to investigate promptly and determine whether an error occurred within 10 business days of receiving notice, report the results within three business days of finishing, and correct any error within one business day of that determination. An unauthorized electronic fund transfer is expressly defined as an error, and a bank that requires written confirmation may not delay starting the investigation while it waits for the letter.
If 10 business days is not enough, the institution may take up to 45 days, but only if it provisionally credits the disputed amount within those 10 business days, tells the consumer of the credit within two business days, and gives full use of the money during the investigation. It may hold back a maximum of $50 from that credit. The 45-day limit stretches to 90 days for point-of-sale debit card transactions, transfers not initiated within a state, and transfers on an account opened within the prior 30 days. The rule also bars the bank from charging for any part of the error-resolution process, including documentation or investigation, when an error did in fact occur.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
More Financial Reading
