Federal credit-card protections put a $50 ceiling on qualifying unauthorized charges made with a lost or stolen card before the issuer is notified, and many card agreements reduce the consumer’s share to zero. The protection is stronger when the theft is caught earlier: reporting the card before anyone uses it leaves the cardholder with no liability. If the physical card remains safe and only the account number is stolen, the consumer generally owes nothing for unauthorized use. Those distinctions explain why credit-card fraud does not follow the same loss timetable as debit-card theft.
Physical Possession Determines Which Liability Rule Starts
A missing physical card gives a thief an access device the issuer has not yet disabled. If the cardholder reports the loss before any unauthorized purchase, federal rules do not allow liability for later use. If charges occur first, the maximum qualifying liability is $50. The cap is not a deductible automatically added to every dispute; an issuer can waive it, and the consumer cannot owe more than the amount actually charged without authorization.
The CFPB’s credit-card guidance also separates stolen credentials from a stolen card. When someone obtains and uses only the account number while the cardholder retains the card, the consumer generally has no liability. That situation now covers much online fraud, where a merchant never sees the physical card. The issuer still needs prompt notice to investigate, replace credentials and prevent additional attempts.
Regulation Z’s unauthorized-use rule limits liability only when specified conditions are met, including that the card issuer has provided an accepted means of identifying the authorized user and a method for notifying it of loss or theft. The issuer may require reasonable identification and cooperation during the inquiry. Those conditions prevent the $50 figure from becoming a blanket rule for every disagreement with a merchant or every transaction later regretted.
Free retirement updates: Scam calls targeting retirees change every week. The free Retirement Shield newsletter flags the ones going around and the one tell that stops each. Sign up free.
Billing-Error Rights Protect the Account While the Charge Is Investigated
An unauthorized charge is also a billing error, bringing a separate dispute process into play. The consumer should contact the issuer immediately and may preserve statutory billing-error rights by sending written notice to the address designated for disputes within 60 days after the statement containing the charge was sent. That address can differ from the location used for payments. An app report may stop the card quickly while a written notice protects the formal dispute record.
The FTC’s lost-card guidance underscores that reporting speed controls protection. Under the billing-error process, the issuer generally must acknowledge a written notice within 30 days unless it resolves the matter sooner, then complete its investigation within two billing cycles and no more than 90 days. During the inquiry, the consumer can withhold the disputed amount and related finance charges while remaining responsible for undisputed portions of the bill.
That separation is the cash-flow advantage of a credit card. The disputed purchase occupies part of a credit line but does not immediately remove cash from a checking account. A debit-card victim may lose access to rent or grocery money while a bank investigates, even if provisional credit later arrives. A credit-card holder still faces available-credit pressure and possible account disruption, but the unauthorized charge generally remains the issuer’s receivable during the formal dispute.
Unauthorized use also has a narrower meaning than “a charge the cardholder did not expect.” A family member or other person given authority to use the card can create valid charges even if they exceed informal instructions, depending on the facts and whether authority was revoked. A deceptive merchant charge may be disputed through other billing-error or consumer-protection rules. The lost-card liability cap specifically addresses use by someone without actual, implied or apparent authority from which the cardholder receives no benefit.
Zero-Liability Policies Add Protection but Do Not Replace Federal Rights
Major issuers commonly advertise zero liability for unauthorized transactions. Those contract promises can eliminate the federal maximum, but they may contain reporting and cooperation requirements. The durable legal baseline remains useful because it sets an outside ceiling when a voluntary policy is unclear or a claim falls into a disputed area. The cardholder agreement can be more generous than federal law; it cannot use ordinary terms to make qualifying liability exceed the statutory conditions.
A prompt report also reduces secondary costs that the $50 cap does not measure. Replacing the account number can disrupt recurring bills, stored merchant credentials and digital wallets. Fraud may consume available credit during travel or a medical expense, and a mishandled dispute can produce fees or adverse reporting that require correction. Stopping use early shrinks the number of transactions that have to be sorted from legitimate spending.
The $50 rule is best read as a legal ceiling around a specific risk, not a reason to tolerate a missing card. Reporting before use produces the strongest result: no liability and a disabled credential. Reporting after unauthorized physical-card use still limits qualifying exposure, while number-only theft generally leaves no consumer liability. The issuer’s investigation determines whether the charge was truly unauthorized, but federal law prevents a stolen revolving credit line from turning automatically into the cardholder’s debt.
This article was produced with AI assistance and reviewed by The Money Overview editorial team.
More Financial Reading
