Federal law caps how much a consumer can lose to an unauthorized bank charge or transfer, but the protection is built on a clock. The size of that cap depends almost entirely on how fast the fraud is reported, and the amount at stake can swing from zero to an entire account balance based on nothing more than timing. For retirees living on a fixed income, understanding those deadlines is the difference between a temporary annoyance and a permanent loss.
The debit-card and bank-transfer clock
Money that moves electronically out of a checking or savings account, whether by debit card, ATM withdrawal, or an automated bank transfer, falls under the Electronic Fund Transfer Act and its implementing rule, Regulation E. Under that framework, a consumer’s liability for unauthorized transfers rises in tiers as more time passes, and the worst tier has no ceiling at all.
The tiers are spelled out in the regulation itself, at 12 CFR 1005.6. Reporting a lost or stolen card or access device within two business days of learning about it caps the loss at $50. Waiting longer than two business days, but still reporting within 60 days of the statement that shows the fraud, raises the exposure to as much as $500. Letting more than 60 days pass after that statement is mailed can leave a consumer liable without limit for the unauthorized transfers that occur after the window closes. When no card is involved, and a thief has simply captured an account number, reporting within 60 days of the statement generally holds the loss to zero, which is why reviewing statements promptly matters so much.
Free for readers: Scam calls targeting retirees change every week. The free Retirement Shield newsletter flags the ones going around and the one tell that stops each. Sign up free.
Credit cards work differently, and better
Credit cards run on a separate and more forgiving set of rules under the Fair Credit Billing Act. According to the FTC’s guidance on using credit cards and disputing charges, the most a cardholder can be held responsible for after a card is used fraudulently is $50, and many issuers advertise zero-liability policies that waive even that. A billing error or unauthorized charge should be disputed in writing within 60 days of the statement date on which it appears, which preserves the right to a formal investigation. The practical lesson is that a credit card places the bank’s money at risk during a dispute, while a debit card places the consumer’s own cash at risk, which is one reason many advisers suggest using a credit card for online and travel purchases where fraud is more likely.
How to report, and what the bank must do
The Consumer Financial Protection Bureau’s plain-language guidance on what to do about an unauthorized transaction recommends contacting the bank or card issuer immediately, then following up in writing to lock in the reporting date. A phone call starts the clock, but a written record, whether a letter or a secure message kept as a copy, is the evidence that proves when the report was made. Once notified of an error, a financial institution must investigate, and under Regulation E it generally has 10 business days to resolve the claim or issue provisional credit while it continues to look, with the full investigation allowed up to 45 days in many cases. If the bank ends up crediting the account temporarily, that money stays available while the review proceeds. Keeping a log of the date, time, and name of every representative contacted turns a he-said dispute into a documented one, and requesting a written confirmation of the dispute date protects the consumer if the timeline is later challenged.
The gap the rules do not cover
One hard limit is worth understanding before trusting the caps too far. Regulation E protects against transfers a consumer did not authorize, such as a thief using a stolen debit-card number. It offers far less protection when a scammer manipulates the victim into sending the money personally, by convincing an older adult to wire funds, send a peer-to-peer payment, or move savings into a so-called safe account. Because the accountholder technically approved the transaction, banks frequently deny reimbursement on these authorized-payment scams, which have climbed sharply among retirees. That gap is the reason prevention matters as much as any reporting deadline: verifying an urgent money request through a separate, already-known phone number before sending a cent is often the only defense that works. Money sent by wire or through a payment app is especially difficult to recover once it lands in a fraudster’s account.
Why the deadlines hit retirees hardest
The 60-day statement window is the quiet trap. The FTC’s overview of lost or stolen cards makes clear that the protections shrink for anyone who does not catch the fraud on a statement quickly. A retiree who reviews accounts only occasionally, or who still receives paper statements weeks after transactions post, can blow past the deadline without ever seeing the charge. Older adults are also disproportionately targeted by scams that produce these exact charges, from fake tech-support fees to impostor callers who talk someone into authorizing a transfer. Setting up account alerts for withdrawals and new transactions, and checking balances weekly rather than monthly, compresses the time between a fraudulent transfer and the report that caps the loss.
The takeaway on money at risk
There is no upside to waiting. Every day between the fraud and the report can raise the amount a consumer is on the hook for, and the difference between reporting on day two and reporting on day 61 can be the entire balance of an account. The rules were written to reward speed, and they only work for the person who acts. Reviewing statements as they arrive, reporting anything unfamiliar the same day, and putting the complaint in writing are the three steps that keep federal liability caps on the consumer’s side rather than the bank’s.
Free for readers: Miss an enrollment or claim deadline and it’s gone. The free Retirement Shield newsletter keeps readers ahead of the ones that matter. Get the free newsletter.
This article was researched and drafted with AI assistance and reviewed against the linked primary sources.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
