Home › Save › Debit vs. credit card fraud
Direct answer: Credit cards cap your loss from unauthorized charges at $50 by law, and you don't pay disputed charges while the issuer investigates. Debit cards are covered by Regulation E: $50 if you report within 2 business days, up to $500 after that, and possibly more after 60 days from your statement, while real cash is gone during the investigation.
By the numbers: If you report a lost or stolen debit card more than 60 calendar days after your statement is sent, your maximum loss is all the money taken from the account, and possibly more. Source: FTC: Lost or Stolen Credit, ATM, and Debit Cards
“Carefully check your ATM or debit card transactions because they take money from your account right away.” — Federal Trade Commission, Lost or Stolen Credit, ATM, and Debit Cards
Updated 2026-10-20
Debit is usually worse. Credit card liability for unauthorized use is capped at $50 by law (Regulation Z), and the money isn't yours until you pay the bill. Debit fraud takes cash out of your checking account immediately, liability can reach $500 or more under Regulation E, and you may wait up to 10 business days for even a provisional credit.
$0 if you report it before it's used; up to $50 if you report within 2 business days of learning it's missing; up to $500 after that; and for unauthorized transfers on a statement you don't report within 60 days of the statement, you can be liable for later transfers the bank shows would have been prevented, with no dollar cap (12 CFR 1005.6).
It has 10 business days to investigate. If it needs longer (up to 45 days, or 90 days for point-of-sale debit card purchases, foreign transactions or new accounts), it must generally put a provisional credit in your account within 10 business days, and may hold back up to $50 (12 CFR 1005.11).
$50, and only if the issuer gave the required notice and a way to report; many issuers charge $0. If only your card number was stolen (you still have the card), the FTC says you aren't responsible for any unauthorized charges.
Call the issuer right away, then send a written billing error notice to the dispute address on your statement within 60 days after the first statement showing the charge. The issuer must acknowledge it within 30 days and resolve it within two billing cycles (no more than 90 days). You don't have to pay the disputed amount meanwhile (12 CFR 1026.13).
No. Visa and Mastercard zero-liability policies are network rules your card issuer follows, with exclusions (some commercial and prepaid cards, transactions not processed on the network) and conditions such as reasonable care and prompt reporting. The legal floor is Regulation E for debit and Regulation Z for credit.
How we make money (partner links never change a pick)
As of Oct. 20, 2026
Sources: 12 CFR 1005.6 · 12 CFR 1026.12(b) · 12 CFR 1026.13 · FTC: lost or stolen cards.
| When you report | Debit or ATM card (Reg E) | Credit card (Reg Z) |
|---|---|---|
| Before anyone uses it | $0 | $0 |
| Within 2 business days after you learn the card is lost or stolen | Up to $50 | Up to $50 (many issuers: $0) |
| After 2 business days, within 60 days after the statement is sent | Up to $500 | Up to $50 |
| More than 60 days after the statement showing the transfer | Transfers after day 60 and before you report that the bank shows you could have stopped: no dollar cap | Up to $50; billing-error dispute rights end at 60 days |
| Only the number was stolen (you still have the card) | $0 if reported within 60 days of the statement | $0 |
Maximum you can be held liable for under federal law. Extenuating circumstances (like a hospital stay or long trip) extend the debit deadlines. State law or your account agreement can only lower these amounts. Sources: 12 CFR 1005.6 · 12 CFR 1026.12(b) · FTC: lost or stolen cards.
| Step | Debit (Reg E 1005.11) | Credit (Reg Z 1026.13) |
|---|---|---|
| You report (phone is fine) | Bank may require written confirmation within 10 business days, or it can skip the provisional credit | Call, then send a written billing-error notice within 60 days of the first statement showing it |
| First deadline | Decide within 10 business days (20 if the account is under 30 days old) | Acknowledge in writing within 30 days |
| If it needs longer | Provisional credit within 10 business days (may hold back up to $50), then up to 45 days total | Resolve within 2 billing cycles, no more than 90 days |
| Longest | 90 days for point-of-sale debit card purchases, transfers not initiated in a state, or new accounts | 90 days |
| Your money meanwhile | Gone from checking until credited; full use of any provisional credit | You don't pay the disputed amount; no collection on it |
Sources: 12 CFR 1005.11 · CFPB: getting your money back · 12 CFR 1026.13.
ILLUSTRATIVE Made-up numbers to show how the rules apply.
Sources: 12 CFR 1005.6 · 12 CFR 1005.11 · 12 CFR 1026.12(b).
Sources: FTC: lost or stolen cards · 12 CFR 1005.11 · 12 CFR 1026.13.
Facts, not legal advice. These are the federal rules with dates. Your card agreement and state law may give you more protection.
Debit is usually worse. Credit card liability for unauthorized use is capped at $50 by law (Regulation Z), and the money isn't yours until you pay the bill. Debit fraud takes cash out of your checking account immediately, liability can reach $500 or more under Regulation E, and you may wait up to 10 business days for even a provisional credit.
$0 if you report it before it's used; up to $50 if you report within 2 business days of learning it's missing; up to $500 after that; and for unauthorized transfers on a statement you don't report within 60 days of the statement, you can be liable for later transfers the bank shows would have been prevented, with no dollar cap (12 CFR 1005.6).
It has 10 business days to investigate. If it needs longer (up to 45 days, or 90 days for point-of-sale debit card purchases, foreign transactions or new accounts), it must generally put a provisional credit in your account within 10 business days, and may hold back up to $50 (12 CFR 1005.11).
$50, and only if the issuer gave the required notice and a way to report; many issuers charge $0. If only your card number was stolen (you still have the card), the FTC says you aren't responsible for any unauthorized charges.
Call the issuer right away, then send a written billing error notice to the dispute address on your statement within 60 days after the first statement showing the charge. The issuer must acknowledge it within 30 days and resolve it within two billing cycles (no more than 90 days). You don't have to pay the disputed amount meanwhile (12 CFR 1026.13).
No. Visa and Mastercard zero-liability policies are network rules your card issuer follows, with exclusions (some commercial and prepaid cards, transactions not processed on the network) and conditions such as reasonable care and prompt reporting. The legal floor is Regulation E for debit and Regulation Z for credit.
Estimates, not financial advice. Taxes, insurance, PMI and fees vary by lender, county and city; confirm with your lender, dealer and state agency before acting.