A debit card charge nobody authorized sets two clocks running at once, and each starts on a different day. Federal Regulation E gives the customer 60 days to report the problem, counted from the statement that shows it. It then gives the bank 10 business days to decide whether an error happened, or 20 business days when the account is new, with provisional credit as the price of taking longer.
Regulation E’s 60 days run from the statement, not the swipe
The customer’s window is written into the error-resolution rule, 12 CFR 1005.11. A bank has to investigate a notice of error that it receives “no later than 60 days after the institution sends the periodic statement” required by the account-disclosure rules. The starting gun is the day the bank sent the statement.
That is why a charge spotted late in a statement cycle is not the emergency it looks like. The statement that first lists it starts the 60 days, so a customer who reads the statement the week it goes out has nearly the whole window left. A customer who lets a statement sit unopened is spending days from the same clock.
Ten business days to decide, one to fix, three to report
Once a notice of error arrives, the bank “shall investigate promptly and, except as otherwise provided,” must “determine whether an error occurred within 10 business days of receiving a notice of error.” Three further deadlines hang off that one. The bank must report its results within three business days after finishing, and it must correct the error within one business day after deciding that one occurred. The same rule lets a bank require written confirmation of an oral report within 10 business days of the phone call.
Business days exclude weekends and federal holidays, so ten of them usually means about two calendar weeks. A bank that gets a phone report on a Monday has until the second Monday after it to decide, if no holiday intervenes.
Provisional credit buys the bank up to 45 days
A bank that cannot finish in 10 business days is not stuck. The rule lets it “take up to 45 days from receipt of a notice of error,” but only if it provisionally credits the account for the amount in dispute, with interest where applicable, within those same 10 business days. It must also tell the customer, within two business days after crediting, the amount and date of the credit, and give “full use of the funds during the investigation.”
The Consumer Financial Protection Bureau’s consumer guidance on getting money back after an unauthorized transaction puts it in plain terms: the bank “must generally issue a temporary credit” for the disputed amount, “minus a maximum of $50.” The $50 holdback applies when the bank has a reasonable basis to believe a transfer was unauthorized. The CFPB page, last reviewed August 28, 2026, also notes that a bank may ask for written confirmation when the first report was made by phone.
New accounts get 20 business days, and some debits get 90 days
Two exceptions stretch both clocks, and both sit in paragraph (c)(3) of the same section, which the CFPB reproduces in its annotated copy of Regulation E. Where the disputed transfer happened “within 30 days after the first deposit to the account was made,” the applicable time is “20 business days in place of 10 business days.” The investigation period with provisional credit also grows from 45 days to 90 days in three situations: the transfer was not initiated within a state, it resulted from a point-of-sale debit card transaction, or it occurred within 30 days after the first deposit.
The point-of-sale category matters most for everyday shoppers. A dispute over a charge made by debit card at a register or online checkout can keep the provisional credit in place for up to 90 days instead of 45, although the first decision point at 10 business days is unchanged for an established account. The 20-business-day extension applies only to the short window after an account’s first deposit, not to every transaction on a young account.
What the 60-day line does to liability
The 60 days also sets how much of a loss the customer carries. Under 12 CFR 1005.6, reporting a lost or stolen card within two business days of learning of it caps liability at the lesser of $50 or the unauthorized transfers made before notice. After two business days the cap rises to the lesser of $500 or the sum of the first $50 plus transfers made after the second business day and before notice.
The statement rule sits beside those caps. Section 1005.6(b)(3) says a consumer “must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution’s transmittal of the statement to avoid liability for subsequent transfers.” The CFPB’s guidance warns that a customer who waits past the 60 days could also be on the hook for the full amount of the transactions that follow. Paragraph (b)(4) adds that when delay was due to extenuating circumstances, the institution “shall extend the times specified above to a reasonable period.”
The rule text itself, last amended in a February 2018 Federal Register notice and published on eCFR, remains the controlling record for every number above, and the CFPB’s August 2026 consumer page repeats the 10-business-day, 20-day, 45-day and 90-day figures in its own words.
Keeping the dates straight while a bank investigates
A reported bad debit under Regulation E leaves the customer holding several dates the bank will not volunteer: the day the statement was sent, the day the bank received notice, and where the 10 business days, 45 days, 20 business days or 90 days end. A phone report also needs written confirmation inside 10 business days, so a missed note can quietly cost the customer the paper trail.
The Bank Account & Debt Protection Kit is a 10-page kit that includes a protected-funds and dispute log, a place to record notice dates, provisional-credit dates and what the bank said at each step.
Open The Bank Account & Debt Protection Kit’s dispute log for the bank’s clocks →
This piece was drafted with AI assistance; the deadlines and liability caps were checked against the eCFR text of 12 CFR 1005.11 and 1005.6 and the CFPB’s consumer guidance.
