What should you do about an unauthorized debit card charge?
Contact your bank immediately through its official app, the number on your card or a verified website. Report the transaction as unauthorized, ask how to secure the account and keep a case number. If the card is missing, report that too. Locking a card or watching a pending charge does not replace notifying the bank.
U.S. consumer guidance reviewed November 1, 2026. This guide focuses on consumer electronic fund transfers, not business accounts or every type of wire or payment. Legal protections depend on the facts. Guidance can change, and updates may take time to appear here; check current CFPB resources and your institution's procedures. The cover is an AI-generated conceptual illustration.
First confirm what you are seeing—without delaying the report
A merchant may use a different billing name, and a hotel or gas station may place a temporary authorization hold. Check the amount, date and any receipt or household purchase you recognize. But if the transaction appears unauthorized, promptly contact the bank rather than spending days investigating alone.
An unfamiliar charge is not always an unauthorized transfer. A purchase you made but now regret, a subscription you forgot to cancel and a merchant refund dispute can involve different rules. Explain the facts accurately. Do not claim fraud simply because the merchant has poor service or an inconvenient cancellation process.
What are the debit card reporting deadlines?
Two important rules address different situations. When a debit card or other access device is lost or stolen, reporting within two business days after learning of the loss generally limits liability to the lesser of $50 or unauthorized transfers before notice. Separately, report a statement-discovered unauthorized transfer within 60 days after the bank sends the statement showing it.
| Situation | General federal consumer rule |
| --- | --- |
| You report a lost or stolen card before unauthorized use | You generally are not liable for later unauthorized transfers. |
| You report within two business days after learning of loss or theft | Liability is generally limited to the lesser of $50 or unauthorized transfers before notice. |
| You report loss or theft after two business days | Liability can rise to as much as $500, subject to the rule's conditions and proof requirements. |
| You delay beyond 60 days after a statement showing an unauthorized transfer is sent | You can face liability for certain subsequent transfers the bank establishes could have been prevented by timely notice. |
These are general federal limits, not automatic charges the bank must impose. A bank's policy may offer more protection. The 60-day rule does not mean every transfer automatically becomes your responsibility on day 61; the law distinguishes earlier losses and certain later preventable transfers. Extenuating circumstances can also affect the timing rules.
If your physical card remains in your possession but its number is used without authorization, the lost-device two-day rule is not the same situation. The statement reporting requirement still matters. Do not wait for any deadline: report immediately.
Worked example: a missing card versus a statement error
Taylor discovers a missing debit card on Monday and calls the bank on Tuesday. Assuming ordinary business days, that report is within two business days of learning of the loss. If $120 was taken through unauthorized transfers before notice, the general liability cap in that situation is $50—not necessarily a guaranteed $50 loss, because bank policy and the facts can reduce it.
Now consider a different situation: Taylor still has the card but sees an unauthorized $120 transfer on a statement the bank sent October 5. Taylor should report it as soon as it is noticed and no later than the applicable 60-day statement period. That clock runs from when the statement was sent, not when Taylor happens to open it.
These are hypothetical examples, not a determination of anyone's legal liability. Keep the statement date, discovery date and reporting date because they answer different questions.
What information should you give the bank?
State your name and account identification through the bank's secure channel. Describe the transaction date, amount and why you believe it is unauthorized. Say whether the card or another access device is missing and when you learned that.
Ask for the case number, whether a replacement card or account-security action is needed, and how to submit supporting documents. Keep copies of messages, receipts and statements. Record when and how you notified the bank; a card-lock confirmation alone may not document a formal error report.
The bank may request written confirmation after an oral report. Ask for the submission instructions and deadline. Failure to provide requested written confirmation within the applicable period can affect provisional credit, so respond promptly and retain proof of submission.
How long does a debit card dispute investigation take?
For covered electronic fund transfer errors, the bank generally has 10 business days to investigate after receiving notice. If it needs longer, it can generally extend the investigation to 45 days by providing provisional credit within the initial period and meeting other requirements. Some circumstances have different timelines, including certain new-account, point-of-sale and foreign-initiated transfers.
Under Regulation E, certain investigations can extend to 90 days, and qualifying new-account cases can have a 20-business-day initial period. These exceptions are why “the bank must refund you in 10 days” is an unreliable blanket promise. Ask which timeline applies to your case and whether credit is temporary or final.
If an error is established, correction generally must occur within one business day of that determination, and the bank generally reports its results within three business days after completing the investigation. If it finds no error, ask for the written explanation and information about requesting the documents used in the decision.
What if a scammer persuaded you to send money?
A scam-induced payment is not always legally equivalent to a card charge made without your authorization. Who initiated the transfer, what the consumer actually authorized and the payment method can matter. Report the incident immediately and explain exactly what happened; do not assume either guaranteed reimbursement or no protection.
Never give a caller a verification code or transfer funds to a supposedly “safe” account. Independently call your bank. If the bank's handling remains unresolved, consider a CFPB complaint and qualified legal assistance for a significant loss.
Your next step
Secure the account, make the report and save the case details today. Then review recent transactions and scheduled bills so a replacement card does not cause missed payments. Read holiday shopping scam checks, free credit freezes and ACH versus wire transfers for related protections.
Sources
MoneyPatrol is not a financial, tax, investment, legal or accounting advisor. This article is for general educational purposes only and is not a substitute for personalised advice from a qualified professional. See our full disclaimer.
