Federal law caps how much a bank customer can be forced to pay for a fraudulent charge, but the size of that cap depends entirely on how quickly the fraud gets reported, and for a debit or ATM card the clock effectively runs out after 60 days. A charge reported before that window closes is capped at a few hundred dollars at most; one reported after it can leave a customer liable for the full amount taken, and potentially more if the fraud drained a linked account. The distinction rarely comes up until the moment someone notices an unfamiliar charge and has to decide how fast to act.
How Federal Law Splits Credit Cards From Debit and ATM Cards
Credit cards and debit or ATM cards are governed by different consumer-protection laws with different math. Under the rules that apply to credit cards, a cardholder who reports fraud after a card was already used owes at most $50, regardless of how much time passed before the report was made, and many issuers waive even that amount as a matter of policy. Debit and ATM cards work under a separate law that ties the liability cap directly to timing, which is why the same missing $50 protection on a credit card does not carry over to a checking account.
That gap matters because a debit card draws money directly out of a bank account rather than extending a line of credit, so a delay in reporting can mean real cash is gone before a bank can freeze the account or reverse a transaction. The FTC’s guidance lays out the debit and ATM timeline in stark terms: reporting before any unauthorized charge occurs limits the loss to zero, reporting within two business days of learning about the loss caps it at $50, and reporting after that but within 60 calendar days of the statement being sent caps it at $500. Waiting past that 60-day mark removes the cap entirely.
Many banks and card networks also promise zero-liability protection that goes further than the federal minimums, refusing to hold a customer responsible for any unauthorized charge regardless of timing. That protection is a company policy layered on top of federal law, not a legal requirement, so its terms can vary by issuer and by card type, and it typically comes with its own conditions, such as reporting the loss promptly and having kept reasonable care of the card and its PIN. A customer relying on a bank’s zero-liability promise should not assume it automatically matches the strongest protection available elsewhere, since the underlying federal floor still shifts based on how quickly the fraud is reported.
Free retirement updates: Want plain-English help keeping more of your money in retirement? The free Retirement Shield newsletter covers the benefits, deadlines, and money mistakes that cost retirees, a couple times a week. Subscribe free.
Why the 60-Day Window Is Written Into Federal Regulation
The 60-day figure comes directly from Regulation E, the federal rule implementing the Electronic Fund Transfer Act. Under its consumer-liability provision, a customer who fails to notify a financial institution within 60 days of the date it sends the statement showing an unauthorized transfer can be held liable for any unauthorized transfers that occur after the 60-day period closes and before notice is finally given. The rule illustrates the stakes with a stark example: if an account is debited $200 without authorization and then hit with a second, $400 unauthorized transfer on the 61st day, a customer who waits until the 62nd day to report the first charge can be held liable for the full $400 that followed.
The clock starts running from the date the statement is sent, not from the date the fraudulent charge actually occurred, which means a charge buried on page three of a monthly statement can quietly age toward that deadline even if the customer has not yet reviewed the account. The rule does build in some flexibility: a bank must extend the reporting window to a reasonable period when a customer’s delay stemmed from extenuating circumstances such as extended travel or hospitalization, but that extension is not automatic and has to be worked out with the institution rather than assumed.
What a Bank Must Do Once a Fraud Report Is Filed
Reporting the charge is only the first step; federal regulation also dictates how quickly a financial institution has to respond. Once a customer files a notice of error, the institution generally must investigate and determine whether an error occurred within 10 business days, and report the results back to the customer within three business days after finishing that investigation. If the investigation cannot be completed that quickly, the institution can take up to 45 days, but only if it provisionally credits the disputed amount back into the account within the first 10 business days and lets the customer use those funds while the investigation continues.
That provisional-credit requirement is what keeps a slower investigation from becoming a second penalty on top of the original fraud: rather than leaving a disputed sum frozen out of reach for over a month, the bank has to restore access to the money while it verifies what happened, then finalize or reverse that credit once the investigation closes. If the institution ultimately determines an error did occur, it must correct the account within one business day of that finding, including any interest or fees the error caused.
The initial report does not have to be in writing to start the clock. A customer can notify a bank by phone or in person, and the institution must begin investigating promptly once it receives that oral notice rather than waiting for a signed statement to arrive. A bank may ask for written confirmation within 10 business days of an oral report, but it cannot delay opening the investigation while that confirmation is in the mail, which means the fastest way to preserve every layer of protection is simply to call as soon as an unfamiliar charge is spotted rather than waiting to draft a formal letter first.
The practical lesson sits less in the dollar figures than in the habit the law rewards. A customer who checks statements soon after they arrive, rather than letting them pile up unopened, gets the benefit of every tier of protection Regulation E provides, while a customer who reviews an account only occasionally risks discovering a fraudulent charge after the window that limits the damage has already closed. The difference between a $50 loss and an unlimited one, in most cases, comes down to nothing more than how quickly the statement got opened.
This article was drafted with AI assistance and edited for accuracy.
More Financial Reading
