Anyone who has spotted a charge they did not authorize on a debit card knows the panic that follows: the money is already gone from the checking account, and bills keep coming. Federal law, however, puts the burden squarely on the bank to prove a transaction was authorized and, when it cannot, to return the funds. Under the Electronic Fund Transfer Act and its implementing rules, a financial institution generally has 10 business days after receiving a consumer’s error notice to investigate and resolve the dispute. If it needs more time, it must provisionally credit the account while the review continues. Consumer liability for a truly unauthorized transfer is capped at $50 or $500, depending on how quickly the cardholder reports the problem.
Why the 10-business-day clock matters for debit-card disputes
The speed at which a bank restores disputed funds can determine whether a consumer misses rent, bounces a utility payment, or falls behind on groceries. The federal statute that controls this timeline is 15 U.S.C. 1693f, which establishes the error-resolution framework for electronic fund transfers. Per that statute, if an institution chooses to provisionally recredit a consumer’s account, it must do so within 10 business days after receiving notice of the error. The CFPB’s implementing rule, Regulation E procedures, spells out the duties a bank must follow once a consumer files a notice of error, including the requirement to determine whether an error occurred within that same 10-business-day window.
The Office of the Comptroller of the Currency reinforces this timeline in its own consumer guidance, stating that if a dispute remains unresolved after 10 days, the bank must temporarily credit at least part of the disputed amount while the investigation continues. That dual-regulator confirmation matters because national banks supervised by the OCC and institutions supervised by the CFPB both operate under the same statutory deadline, yet no publicly available enforcement data shows how often banks actually meet or miss it. The hypothesis that provisional-credit timing correlates more closely with a bank’s primary federal regulator than with its fraud volume alone remains untested in any published dataset. Without that data, consumers cannot easily compare banks on dispute-resolution speed before opening an account.
For households living paycheck to paycheck, the difference between a prompt provisional credit and a delayed one can be the difference between financial stability and cascading fees. A bank that waits until the end of an investigation to restore funds may trigger overdrafts, late-payment penalties from landlords or utilities, and damage to a consumer’s credit profile. By contrast, a bank that follows the 10-business-day rule and issues a timely provisional credit effectively shields the customer from those secondary harms while it sorts out the underlying fraud claim. That is precisely the consumer-protection logic behind the statutory deadline.
Liability caps and reporting deadlines that protect cardholders
Federal law does not leave consumers fully exposed even when they are slow to report fraud. Under Regulation E liability rules, a consumer who reports an unauthorized transfer within two business days of learning about a lost or stolen card faces a maximum liability of $50. Waiting longer than two business days but reporting within 60 days of the statement date raises the cap to $500. After the 60-day window closes, the consumer risks unlimited liability for transfers that occur after that deadline. The FDIC’s consumer guidance echoes these thresholds and stresses the importance of reviewing statements promptly so that any unauthorized transfers are spotted and reported within the 60-day period.
These liability caps interact closely with the 10-business-day investigation rule. The sooner a consumer reports suspicious activity, the lower their potential out-of-pocket loss, and the sooner the bank’s investigation clock starts running. Prompt reporting not only preserves the $50 or $500 cap but also accelerates the point at which provisional credit may be issued. In practice, that means checking online and mobile banking activity regularly, not just waiting for a monthly paper statement to arrive.
Consumers also need to understand what counts as a “notice of error” sufficient to trigger the bank’s obligations. Regulation E allows a notice to be oral or written, as long as it identifies the consumer’s name and account number, explains why the consumer believes an error occurred, and includes enough information to investigate, such as the date and amount of the disputed transfer. Many banks encourage customers to use secure messaging or dedicated fraud hotlines, but a timely phone call that meets these elements can be enough to start the 10-business-day clock.
Once a notice is received, the institution must investigate in good faith, report its findings, and correct any error promptly. If it concludes that no error occurred, it must explain its reasoning and inform the consumer of the right to obtain documentation. When provisional credit has been provided and the bank ultimately determines the transaction was authorized, it may reverse the credit after giving advance notice. That possibility makes it important for consumers to respond to bank requests for information and to file police reports or affidavits when asked, so that legitimate claims are not denied for lack of cooperation.
Although the legal framework is clear, enforcement visibility remains limited. Consumers rarely see statistics on how often banks fail to meet the 10-business-day deadline or how frequently provisional credits are reversed. Until regulators publish more granular data, individuals can protect themselves by reporting unauthorized activity quickly, keeping records of when and how they notified their bank, and escalating complaints to the appropriate regulator if timelines are not honored. The combination of statutory deadlines, liability caps, and provisional-credit requirements gives consumers meaningful leverage-provided they know the rules and invoke them without delay.
