Your Liability for Unauthorized Credit and Debit Card Charges

Learn how to limit your liability for unauthorized charges to your credit, debit, or prepaid card.

Updated by , Attorney · University of Denver Sturm College of Law

The theft or loss of a credit card, debit card, ATM, or prepaid card can happen to anyone. You need to be prepared to take action, protect your rights, and stop thieves in their tracks.

If your credit card, debit card, ATM, or prepaid card is lost or stolen, don't panic. Federal laws and bank policies limit your liability for unauthorized charges.

But it's important to notify the bank or card issuer of the loss or theft as soon as you discover it.

Laws That Cover Stolen and Lost Credit, Debit, and ATM Cards

The two primary federal laws covering procedures after card theft or loss are the Fair Credit Billing Act and the Electronic Fund Transfer Act.

Reporting a Credit Card as Stolen or Lost

Under the Fair Credit Billing Act, your liability for unauthorized charges depends on whether the thief personally presented your card to make the purchase or just stole the number.

  • If the thief personally presents your card to make the purchase, the card issuer can't hold you liable for more than $50 in fraudulent charges. (12 C.F.R. § 1026.12). Many card issuers waive this $50.
  • You have no liability if the thief stole the number but not the card.

However, in either of the above situations, it's important to notify the card issuer as soon as you know of the theft.

To dispute unauthorized charges, send a letter to the credit card company at the address given for this purpose, not the address for sending your payments. Include your name, address, account number, and a description of the billing error. You may use the Federal Trade Commission's sample letter. Send your letter so that it reaches the creditor within 60 days after the first bill showing the unauthorized charge. (12 C.F.R. § 1026.13).

Or you can file your dispute online or through a mobile banking app. (But you generally get more legal protections with a letter, so it's best to follow up with a written notification.)

After you report your card as stolen or lost, the issuer will suspend the card and send you a new one. This closing of the account is different from canceling or permanently closing a credit card, which can cause problems with your credit reports. The issuer will also credit back any fraudulent charges made to your account, although you can expect them to conduct a fraud investigation.

Reporting a Debit Card or ATM Card as Stolen or Lost

With ATM or debit cards, you must act quickly to avoid full liability for unauthorized charges when your card is lost or stolen. Under the federal Electronic Fund Transfer Act, your liability is:

  • $0 if you report the loss or theft of the card immediately and before any unauthorized charges are made.
  • up to $50 if you notify the bank within two business days after you realize the card is missing
  • up to $500 if you fail to notify the bank within two business days after you realize the card is missing, but do notify the bank within 60 days after your bank statement is mailed to you listing the unauthorized withdrawals, or
  • unlimited if you fail to notify the bank within 60 days after your bank statement is mailed to you listing the unauthorized withdrawals. (15 U.S. Code § 1693g).

If you can convince the bank that your notification failure was due to extenuating circumstances, it must extend the notification timeline for a "reasonable period."

Note that if the theft involved only your ATM or debit card number—and not the card—you're not liable for unauthorized transactions if you report them within 60 days after your statement is sent to you. So, it's important to review your statements promptly.

Voluntary Caps on Liability for Debit Card Charges

In response to consumer complaints about the possibility of unlimited liability, some card issuers cap the liability on debit cards at $50. And some banks don't charge anything if unauthorized withdrawals appear on your statement.

Also, some states have capped the liability for unauthorized withdrawals on an ATM or debit card at $50.

How Prepaid Cards Work

With a prepaid card, you spend money that someone (for example, you, your employer, or the government) has already placed in a prepaid card account. Money is loaded onto the card with direct deposit, checks, or cash. You may then use that card to, for example, pay for goods or services, withdraw cash from ATMs, or pay other costs.

Prepaid cards often have high fees, like monthly fees, activation fees, fees to get cash, customer service fees, reloading fees, bill payment fees, ATM withdrawal fees, overdraft fees, and more. And in the past, most cards didn't protect you if you lost the card or if you needed to dispute an item or service you bought with it. (Credit cards, on the other hand, and to a lesser degree, debit cards, have provided protections in these areas for many years.)

However, on April 1, 2019, the Prepaid Accounts Rule went into effect. This rule provides protections if you lose the card or it gets stolen.

Consumer Protections Under the Prepaid Accounts Rule

The rule requires specific upfront disclosures for prepaid cards, limits a consumer's liability if a card is lost or stolen, and generally makes prepaid cards a safer product for consumers.

Accounts Covered by the Prepaid Accounts Rule

The Prepaid Accounts Rule, sometimes called the "Prepaid Cards Rule," applies to different types of prepaid cards, such as prepaid debit cards, digital wallets, peer-to-peer transfer apps that hold balances (like Paypal or Venmo), some payroll cards, tax refund cards, and certain government benefit cards.

However, other kinds of cards, such as gift cards usable only at a particular store or group of stores, disaster-relief cards, parking reimbursement cards, and health-related cards, aren't affected by the rule.

Required Disclosures

Under the Prepaid Accounts Rule, the financial institution issuing the card must give you specific disclosures before you get a prepaid card. For example, the institution must disclose:

  • your liability for unauthorized electronic fund transfers
  • the telephone number and address of the person or office to be notified when you believe that an unauthorized electronic fund transfer has been or might be made
  • any fees imposed by the financial institution for electronic fund transfers (or for the right to make transfers), and
  • how to resolve errors. (12 C.F.R. § 1005.4, § 1005.7).

Limitation on Losses for Lost or Stolen Prepaid Cards

Once you register the card in your name, the rule also limits your liability when a card is lost or stolen. Your liability for unauthorized electronic fund transfers depends on when you report the loss or theft. (The following information applies in situations when the financial institution provides periodic statements for the prepaid account and the account isn't subject to an exception for unverified accounts.) (12 C.F.R. § 1005.6).

Within two business days. If you tell the financial institution within two business days that your "access device" (see below) has been lost or stolen, then your responsibility for unauthorized charges is limited to:

  • $50 or
  • the amount of unauthorized transfers that occur before you notify the financial institution.

An "access device" is a card, code, or other means of access to a consumer's account, or any combination thereof, that may be used by a consumer to initiate electronic fund transfers.

More than two business days after learning of the loss or theft, and up to 60 days after statement transmittal. If you notify the financial institution more than two business days after learning of the loss or theft, but up to 60 days after transmittal of the statement showing the first unauthorized transfer made with an access device (or when you electronically access your account, depending on the circumstances), your liability can't exceed the lesser of $500 or the sum of:

  • $50 or the amount of unauthorized transfers that occur within the first two business days, whichever is less, and
  • the amount of unauthorized transfers that occur after the close of two business days and before notice to the institution, provided the institution establishes that these transfers would not have occurred had you notified the institution within that two-day period.

More than 60 days after statement transmittal. If you notify the institution about an unauthorized electronic fund transfer that appears on your periodic statement more than 60 days after the statement is transmitted (or when you electronically access your account), for transfers within the 60-day period, your liability is the lesser of $500, or the sum of:

  • the lesser of $50 or the amount of unauthorized transfers in first two business days, and
  • the amount of unauthorized transfers occurring after two business days.

For transfers after the 60-day period, you have unlimited liability until the financial institution is notified, provided the financial institution demonstrates that these transfers would not have occurred had you given notice within the 60-day period.

Limitation on Losses After an Unauthorized Transfer Not Involving Loss or Theft

If the card or access device was not lost or stolen, your liability depends on when you report the unauthorized electronic fund transfer.

Within 60 days. If the access device was not stolen or lost, if you notify the institution within 60 days after transmittal of the periodic statement on which the unauthorized transfer first appears or when you electronically access your account, then you have no liability.

After 60 days. If you report the unauthorized transfer more than 60 days after transmittal of the periodic statement on which the unauthorized transfer first appears or when you electronically access your account, you have unlimited liability for unauthorized transfers that happen 60 days afterward and before notice to the financial institution.

Other Protections Under the Prepaid Accounts Rule

The rule also protects consumers from expensive overdraft penalty fees, provides a process that financial institutions have to follow for investigating and resolving errors, and requires the financial institution to give consumers free and easy access to account information.

How to Protect Your Credit, Debit, ATM, and Prepaid Cards and Information

Know where your credit, debit, ATM, and prepaid cards are, and make sure they're secure. Here are some more tips for using and protecting your cards.

Tips for Using and Protecting Your Credit Card

  • Check your statements and regularly review your account activity either online or on a mobile app.
  • Enable mobile alerts for purchases or suspicious activity. Some credit and debit card issuers also provide free fraud monitoring alerts via text, phone, or email.
  • Exercise caution in giving out your credit card account number over the phone. Don't give out the card number unless you initiate the call.
  • Don't leave blanks on charge slips; draw a line across any blanks.
  • Always take your receipts, and keep them until you reconcile your bill.
  • Cut up or shred your old cards.
  • Review your credit reports to look for new accounts under your name that you didn't open.
  • Carry only the cards you think you'll need.
  • Make and keep a record of your card information, listing the issuer's customer service number, and keep this in a safe place.
  • Ignore anyone contacting you to "verify" your account information by phone or email. The call or message could be a phishing scam designed to steal your account information.

Tips for Using and Protecting Your Debit and ATM Cards

  • Review your statements.
  • Always take your receipts; don't throw them away in a trash can near the ATM.
  • Protect your PIN. Never leave this information out in the open or written down in an easy-to-spot location. Don't keep a copy of your PIN with you or the card.
  • Don't base PINs on common personal information, like your address, family birth dates, or pets' names—those are easy for a thief to figure out.
  • Cut up or shred your old cards.
  • Record your transactions and reconcile your monthly statement promptly.
  • You should also periodically check your account activity, especially if you use online banking. Compare the transactions to those you've recorded and report any discrepancies to your bank right away.

Tips for Using and Protecting a Prepaid Card

  • Don't write down your prepaid card's details, such as the card number, expiration date, and CVC code.
  • Don't share your account number or personal identification number (PIN) with anyone.
  • Be aware of what protections you get under the law.
  • Report your card as lost or stolen as soon as you find out it's missing or you notice suspicious activity so you can take advantage of legal protections.
  • Monitor your balance and keep track of how much money you use so you know how much you have remaining to spend.
  • If you get a call, email, or text asking for your card's personal information, ignore it. Then call the card's customer service number, which is probably on the back of your card, and report the communication. Don't respond to the call or message or click on links within an email or text message.

Learn More

The Federal Trade Commission website is a useful resource for information on consumer protection laws and issues related to credit, debit, ATM, and prepaid cards and their use. If you have an issue with your card issuer or bank, you may submit a complaint to the Consumer Financial Protection Bureau (CFPB). The CFPB will forward your complaint to the company and work to get you a response.

For more information on finances, debts, and how to regain financial health, get Solve Your Money Troubles: Debt, Credit & Bankruptcy, by and (Nolo).

Talk to a Lawyer

Need a lawyer? Start here.

How it Works

  1. Briefly tell us about your case
  2. Provide your contact information
  3. Choose attorneys to contact you
Get Professional Help

Talk to a Consumer Protection attorney.

How It Works

  1. Briefly tell us about your case
  2. Provide your contact information
  3. Choose attorneys to contact you