Federal protections for debit-card theft shrink sharply when an unauthorized transaction sits unreported for more than 60 calendar days after the bank sends the statement showing it. Losses after that point can extend beyond one bad withdrawal to money taken from the affected account and accounts linked to it. The rule makes statement review a legal deadline, not merely a good budgeting habit.
Three clocks determine the maximum exposure
If a lost debit card is reported before any unauthorized transaction, the consumer generally owes nothing for later transfers. Reporting within two business days after learning of the loss or theft generally caps liability at $50. Waiting longer can raise the cap to $500.
A separate 60-calendar-day clock runs from the date the institution transmits a statement containing an unauthorized transfer. After that period, the consumer can be responsible for transfers that would have been prevented by timely notice. The bank must still evaluate which losses occurred within and after the protected period.
Free retirement updates: Scam calls targeting retirees change every week. Our free Retirement Shield newsletter flags the ones going around and the one tell that stops each. Sign up free.
The statement date matters more than discovery alone
The FTC’s current loss table says reporting more than 60 days after a statement is sent can expose all money taken from the debit account and possibly linked accounts. The wording does not mean the bank automatically keeps every disputed dollar; it describes the maximum federal liability after delay.
A consumer who discovers fraud on day 59 should report it immediately rather than wait to gather every document. Telephone or app notice can stop further transfers, while written confirmation supplies the transaction dates and amounts. The institution may ask for a signed statement, but an initial report creates the record that speed matters.
The CFPB guidance stresses contacting the bank or credit union promptly and following up in writing. Card replacement alone may not solve an account-number compromise, so the institution should confirm whether the underlying account needs to be restricted or replaced.
Card loss and account-number theft differ
When the physical card remains in the consumer’s possession but account information is used, the two-business-day lost-card rule may not apply in the same way. Reporting an unauthorized electronic transfer within 60 days of the statement remains essential. The precise facts determine which liability provision controls.
The current Regulation E liability rule explains that extended losses must be connected to the failure to notify. The institution has to show that timely notice would have prevented transfers occurring after the 60-day period before imposing that additional liability.
Extenuating circumstances, such as an extended trip or hospitalization, can require the institution to extend a deadline for a reasonable period. That exception is fact-specific and should be documented. It is not a safe reason to postpone a report once the fraud becomes known.
Provisional credit is part of the investigation
Regulation E sets procedures and timing for investigating error notices. In some cases the institution can take longer if it provides provisional credit, subject to exceptions. A temporary credit is not a final fraud decision and can be reversed if the investigation concludes the transaction was authorized.
Records should include the statement, transaction list, notice date, case number and every message from the bank. An ATM receipt, police report or identity-theft report may add evidence, but federal error rights do not generally depend on convincing local police to investigate first.
Automatic payments tied to a replaced card or closed account need attention. Mortgage, insurance and utility drafts can fail during the fraud response, creating late fees unrelated to the stolen funds. A written list of linked payments makes account repair less costly.
Alerts help, but statements start the federal deadline
Real-time transaction alerts can reveal theft before a monthly statement arrives. Low-dollar alerts are useful because criminals sometimes test an account with a small purchase before larger withdrawals. Yet alerts do not replace reviewing the official statement that starts the 60-day period.
Credit cards have a different liability framework and do not draw directly from a deposit balance. The debit-card rule is harsher because delayed reporting can allow recurring transfers to drain money needed for housing, medicine or retirement withdrawals. Fast written notice is the practical protection that keeps the statutory maximum from expanding. Delay magnifies the loss.
Joint deposit accounts need a shared fraud-reporting plan
Any authorized owner who sees an unexplained transfer should report it rather than assume another household member made it. Shared credentials and informal card use can make the authorization facts harder to reconstruct, so each user should have a separate bank-issued access method when the institution offers one.
A trusted helper reviewing an older adult’s statements should know the bank’s procedure for receiving notices without sharing passwords. A power of attorney, view-only access or account alert can create legitimate oversight. Giving a helper full credentials can violate account terms and blur whether a disputed transfer was truly unauthorized under federal rules.
This article was researched and drafted with AI assistance and reviewed against the linked primary sources.
More Financial Reading
- Adding someone to your bank account: tax traps and smart moves
- How many CDs can you park at 1 bank? FDIC rules you must know
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
