RitezyNew York legal help
Ask for free

Credit, banks & credit reports · Your right

Unauthorized debit card or bank transfer: how much you can lose and how to get it back

Updated By The editorial teamNot reviewed by an attorney — based on the official sources below

In short

Under the Electronic Fund Transfer Act and Regulation E, your liability for unauthorized debit card, ATM or other electronic transfers from your bank account is limited, and the limit depends on how fast you report. If your card or PIN was lost or stolen and you tell the bank within two business days of learning about it, you can lose no more than $50. After that, up to $500. If you don't report an unauthorized transfer within 60 days after the statement showing it was sent, you could be liable for later transfers the bank shows it could have stopped. Report to the bank by phone, in person or in writing; it must investigate, generally within 10 business days, or credit your account provisionally while it takes longer.

Read on for the details, the exceptions and the sources.

In plain words

Electronic fund transfer
Money moved electronically into or out of your account: debit card purchases, ATM withdrawals, online and app transfers, automatic debits.
Unauthorized transfer
A transfer started by someone else without your permission and that didn't benefit you.
Access device
Your debit card, PIN or other code used to get into your account.
Provisional credit
Money the bank puts back in your account temporarily while it finishes investigating.

What is it?

The Electronic Fund Transfer Act (15 U.S.C. § 1693 ff.) and Regulation E (12 C.F.R. Part 1005) protect consumers' bank accounts against unauthorized electronic transfers and errors. Your liability is capped (15 U.S.C. § 1693g; 12 C.F.R. § 1005.6), and the bank must follow a set error-resolution process once you report (15 U.S.C. § 1693f; 12 C.F.R. § 1005.11). In any dispute, the bank has the burden of proving that a transfer was authorized, or that the conditions for holding you liable were met (§ 1693g(b)).

Who qualifies?

Consumers with an account at a bank or credit union that is accessed electronically. An unauthorized electronic fund transfer is one started by someone other than you, without actual authority, from which you received no benefit (12 C.F.R. § 1005.2(m)). You can be held liable at all only if the bank gave you the required disclosures, and, for card transactions, the card was one you accepted and the bank provided a way to identify you as the authorized user (§ 1005.6(a)).

Exceptions

  • A transfer made by someone you gave your card or access to isn't unauthorized, until you tell the bank that person is no longer allowed to use it (§ 1005.2(m)(1)).
  • Transfers you or someone acting with you made with fraudulent intent aren't covered (§ 1005.2(m)(2)).
  • A payment you started yourself — even one you were tricked into sending — may not count as unauthorized, because the definition covers transfers started by someone else. Report it anyway; other errors and the bank's own policies may still help.
  • If state law or your account agreement gives you a lower liability limit, the lower limit applies (§ 1005.6(b)(6)).

How much?

  • Lost or stolen card or PIN, reported within 2 business days after you learn of it: at most $50, or the amount of the unauthorized transfers if less (§ 1005.6(b)(1)).
  • Reported later: at most $500 — made up of up to $50 for the first two business days plus transfers after that which the bank shows would not have happened if you had reported in time (§ 1005.6(b)(2)).
  • Unauthorized transfers that appear on a statement and that you don't report within 60 days after the statement was sent: you may be liable for transfers after those 60 days and before you report, if the bank shows reporting would have prevented them (§ 1005.6(b)(3)).
  • Transfers after you notify the bank: generally nothing, because the limits count only transfers before notice (§ 1005.6(b)).

How is it calculated?

Work out which tier applies. Example: your wallet is stolen on Monday, you notice that evening, and you call the bank on Tuesday — within two business days. Even if the thief took $900, your share is capped at $50 (§ 1005.6(b)(1)). If you had waited a week, your share could be up to $500, depending on what the bank shows. If your card was never lost — for example, someone copied the card number — the key deadline is reporting within 60 days after the statement showing the first unauthorized transfer was sent (§ 1005.6(b)(3)). The deadlines are extended to a reasonable period if extenuating circumstances, such as extended travel or a hospital stay, delayed you (§ 1005.6(b)(4)).

What documents do you need?

  • Your bank statements, with the unauthorized transfers marked.
  • The date you learned the card was lost or stolen, or first saw the transfers.
  • A record of when and how you notified the bank: call time, representative's name, reference number, and any written confirmation you sent.
  • Any written confirmation the bank asks for — it may require one within 10 business days of a phone report (§ 1005.11(b)(2)).

How do you get it?

  1. Report it to the bank right away

    Call, visit or write. Notice counts once you've taken reasonable steps to give the bank the information, even if the right person doesn't get it; a mailed notice counts when you send it (§ 1005.6(b)(5)).

  2. Lock or cancel the card

    Ask the bank to block the card and any compromised access codes.

  3. Confirm in writing

    If the bank asks, send written confirmation within 10 business days of your call; otherwise it may not have to give provisional credit (§ 1005.11(b)(2), (c)(2)(i)(A)).

  4. Track the investigation

    Note the dates below and ask for the results and the documents the bank relied on.

What if they refuse?

The bank must investigate and decide within 10 business days, or take up to 45 days if it provisionally credits your account within 10 business days (it may hold back up to $50 if it believes the transfer was unauthorized), tells you within 2 business days of the credit, and lets you use the money meanwhile. For new accounts, point-of-sale debit card transactions and transfers started outside the U.S., the periods are longer: 20 business days, and 90 days instead of 45 (§ 1005.11(c)). If it finds no error, it must give a written explanation and, on request, copies of the documents it relied on (§ 1005.11(d)). If it still won't fix it, complain to the CFPB. A bank that violates the law can be liable for your actual damages, plus $100 to $1,000 in an individual lawsuit, plus costs and attorney's fees (15 U.S.C. § 1693m).

Deadlines

  • 2 business days after learning your card or PIN was lost or stolen — to keep the $50 limit (§ 1005.6(b)(1)).
  • 60 days after the bank sent the statement showing the unauthorized transfer or error (§ 1005.6(b)(3); § 1005.11(b)(1)).
  • Written confirmation within 10 business days of a phone report, if the bank asks (§ 1005.11(b)(2)).
  • Bank's decision: 10 business days, or 45 days with provisional credit (20 business days / 90 days in some cases) (§ 1005.11(c)).

Figures that change

  • Liability if a lost or stolen card is reported within 2 business days: Up to $50 (as of 2026-10-30; Regulation E — liability for unauthorized transfers, 12 C.F.R. § 1005.6)
  • Liability if reported later (lost or stolen card): Up to $500 (as of 2026-10-30; Regulation E — liability for unauthorized transfers, 12 C.F.R. § 1005.6)

Frequently asked questions

Someone used my debit card. Will I get my money back?

If you report quickly, your liability is limited: at most $50 if you report within 2 business days of learning your card was lost or stolen, and up to $500 after that (12 C.F.R. § 1005.6(b)). Report unauthorized transfers on your statement within 60 days to avoid larger losses.

How long does the bank have to investigate?

Generally 10 business days. It can take up to 45 days (90 in some cases, such as point-of-sale debit card transactions) if it provisionally credits your account within 10 business days (§ 1005.11(c)).

I was tricked into sending money through an app. Is that unauthorized?

It may not be, because Regulation E defines an unauthorized transfer as one started by someone other than you (§ 1005.2(m)). Report it to your bank and the app immediately anyway, and ask what they can do.

Do I have to report in writing?

No — you can report in person, by phone or in writing (§ 1005.6(b)(5)). But the bank may require written confirmation within 10 business days of a phone report (§ 1005.11(b)(2)), so it is wise to follow up in writing.

Want your own situation checked?

This page is general. Describe what happened, attach the letter or document you received, and get a free first answer — then, if you want, a full check against New York and federal law and a letter ready to send.

Check my situation — free

Official sources

This page was written from the sources below. “Checked” is the date the source was last opened and read.

Related questions

Related guides

This page is general information based on the official sources listed, current as of the update date. It is not legal advice and does not replace a review of your own situation; if a case is already in court, a deadline is close, the amount is large, or there are criminal, immigration or family-law consequences, talk to a lawyer or legal aid.