Federal law puts a hard deadline on how long a bank account holder has to dispute an unauthorized electronic charge before the protection against being stuck with the loss starts to disappear. The rule matters most for anyone who does not review a bank statement line by line every month, since the clock on that protection starts running whether or not the charge has been noticed.
The Two-Day Window That Caps Loss at $50
Under Regulation E, the federal rule implementing the Electronic Fund Transfer Act, a consumer’s liability for an unauthorized transfer made with a lost or stolen debit card or access device is capped at $50, but only if the loss or theft is reported to the bank within two business days of discovering it, according to the Consumer Financial Protection Bureau’s text of the rule. Miss that narrow window and the cap rises sharply, even if the report still comes well before any real financial hardship sets in.
Free retirement updates: Enrollment and claim windows come and go, and missing one can cost real money. The free Retirement Shield newsletter stays ahead of the deadlines that matter. Sign up free.
The 60-Day Deadline Tied to the Statement
Between the two-day mark and 60 days after the bank mails the periodic statement showing the unauthorized transfer, liability rises to a maximum of $500. That 60-day figure is calculated from the statement date, not from the date the charge actually posted, which means a charge sitting unnoticed near the start of a billing cycle eats into the response window faster than it might appear. Once a dispute is reported, the CFPB’s consumer guidance notes that Regulation E’s error-resolution process generally requires the bank to investigate and, in most cases, provide provisional credit for the disputed amount while that investigation is underway, rather than leaving the funds tied up for the full length of the review.
What Happens After the 60-Day Mark
The protection changes meaningfully once the 60-day period from the statement date has passed without a report. At that point, liability is no longer capped at $500; a consumer can be held responsible for the full amount of unauthorized transfers that occur after the 60-day window closes and before the bank is notified, if the bank can show earlier notice would have stopped them. In practice, that makes the 60-day mark the effective deadline for preserving a real chance at a refund, even though the rule is technically framed around what the bank can hold a consumer liable for rather than a strict “use it or lose it” filing date.
A Different Standard When No Card Was Lost or Stolen
The $50 and $500 tiers described above apply specifically when an access device, such as a debit card or PIN, was lost or stolen. Regulation E treats a different scenario — where an unauthorized transfer happens without any card or device having been lost or stolen, such as a fraudulent ACH withdrawal or an unauthorized transfer initiated through a linked payment app — under a separate provision. In that case, liability generally depends only on how quickly the transfer is reported after the statement is sent, without the intermediate $500 tier; reporting within 60 days keeps exposure minimal, while the same unlimited-liability risk after 60 days still applies. The distinction rarely matters to the outcome for someone who reports promptly, but it explains why two people describing seemingly identical debit-account fraud can be quoted different liability rules by their bank.
How the Investigation Itself Is Supposed to Work
Once a dispute is filed, Regulation E’s error-resolution timeline governs how quickly the bank has to act, separate from the liability question. A bank generally has 10 business days to investigate and either correct the error or explain in writing why it found no error occurred; if it needs more time, it must provisionally credit the disputed amount within that same 10-day window while continuing to investigate, up to a maximum of 45 calendar days in most cases. Newly opened accounts, and transactions initiated outside the United States or at a point of sale, can extend those timelines to 20 business days for the initial credit decision and up to 90 days for the full investigation. A consumer who reports a dispute only verbally may also be asked to confirm it in writing within 10 business days to keep the claim active, so a phone call to the bank is a reasonable first step but should generally be followed up in writing.
A Different Rule Applies to Credit Cards
The 60-day exposure under Regulation E is specific to bank accounts and debit-linked transfers; credit card charges are governed by a separate rule, Regulation Z, under which liability for an unauthorized charge is generally capped at $50 regardless of how long it takes to report it, and many card issuers waive that $50 entirely. The distinction is easy to miss for anyone assuming the two forms of plastic carry identical protections, but it is the debit and bank-transfer side of a household’s accounts where the reporting clock actually costs money if it runs out.
This article was produced with the assistance of AI and reviewed by The Financial Wire editorial team.
More Financial Reading
- The ideal retirement withdrawal rate so your savings actually last
- Adding someone to your bank account: tax traps and smart moves
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
