An unfamiliar credit-card charge can feel like an open-ended threat to a household budget. Federal protections put a firm ceiling on what the cardholder can be required to absorb, while fast reporting and careful documentation make the dispute much easier to resolve. A fraudulent charge should be reported immediately, but the size of the charge is not the same as the cardholder’s legal exposure. Knowing that distinction can prevent panic, rushed payments, and costly mistakes.
Free retirement updates: Scam calls targeting retirees change every week. Our free Retirement Shield newsletter flags the ones going around and the one tell that stops each. Sign up free.
How the $50 federal ceiling works
The Federal Trade Commission’s current guidance says that when a physical credit card is lost or stolen and someone uses it before the loss is reported, the maximum amount the cardholder might be responsible for is $50. If the loss is reported before unauthorized use occurs, responsibility is zero. If only the account number is stolen while the card remains in the owner’s possession, the FTC says the cardholder is not responsible for unauthorized charges.
That is a maximum liability rule, not an automatic $50 bill. The CFPB’s current Regulation Z liability rule likewise caps a cardholder’s liability at the lesser of $50 or the amount obtained before notice, and it requires the issuer to show that the use was authorized if it seeks to impose liability. Many issuers advertise zero-liability policies that go beyond the federal floor. The protection applies to unauthorized use, not a purchase the cardholder knowingly made and later regretted; dissatisfaction with merchandise follows a different process.
Why prompt reporting creates a clean record
The first call should go to the number printed on the issuer’s official statement, the back of another card from the same issuer, or the issuer’s authenticated app. Contact information in an unexpected text or email should not be trusted, because a false fraud alert can itself be a phishing attempt. The issuer can block the card, replace the account number, and begin an investigation.
The FTC recommends following the report in writing with the account number, the date and time the card was noticed missing, and the time the loss was first reported. Copies of letters, screenshots, confirmation numbers, and notes from calls create a timeline. A written record matters if a charge reappears, a replacement card is delayed, or the issuer later disputes when notice was given.
The report should distinguish the first suspicious transaction from the time the card or number was known to be compromised. Those are different facts: the liability calculation turns on unauthorized use before notice, while the billing-error deadline turns on the first statement that carried the charge. Recording both dates prevents an issuer’s fraud intake and billing-dispute teams from treating one clock as the other. It also lets the cardholder explain whether the physical card was missing or only the account number was used.
Who the credit-card rule protects
The rule matters most to people who carry several cards, rely on automatic payments, or do not check online accounts every day. Retirees may be especially vulnerable to impostor calls claiming that a large fraudulent purchase must be “verified.” A real issuer may ask whether a transaction is recognized, but a caller who requests a full card number, password, PIN, or one-time login code should not be given that information.
Authorized users and caregivers also need a clear household process. A charge made by a person who had permission to use the card may not qualify as unauthorized merely because the purchase was unexpected. Families should identify which people are authorized, review alerts together when appropriate, and remove old authorized users when access is no longer needed.
Responding to an unauthorized charge
Promptly freeze or lock the card through the issuer’s official app if that feature is available, then call the issuer. Review recent transactions for small “test” charges, subscriptions, and cash-like transactions. Ask whether recurring merchants must be updated after a replacement number is issued, since some network services automatically transfer recurring charges to the new account.
For a formal billing-error dispute, the FTC says a written notice should reach the issuer within 60 days after the first statement containing the error was sent. During an eligible investigation, the cardholder can withhold the disputed amount and related finance charges while continuing to pay the undisputed portion. The issuer generally must acknowledge the complaint within 30 days unless it has already resolved the matter and must resolve it within 90 days. Those procedural duties appear in the CFPB’s separate billing-error resolution rule, which is why a written notice to the designated billing-inquiries address matters even after a phone report.
Where the $50 cap stops
Credit cards and debit cards do not share the same liability timetable. A debit-card theft can expose money already sitting in a checking account, and the possible loss rises when notice is delayed. The $50 credit-card ceiling should never be assumed to govern an ATM card, a debit transaction, a peer-to-peer payment that was knowingly authorized, or cash sent to a scammer.
The rule also does not make account monitoring optional. Quick notice stops further attempts, protects recurring payments from disruption, and preserves evidence. Alerts for purchases, card-not-present activity, and transactions above a chosen amount can shorten the time between fraud and discovery. Statements should still be reviewed because alerts can fail or be disabled after an account takeover.
Securing the account after the dispute
A frightening number on a statement does not determine the final loss. The federal credit-card rule limits the cardholder’s exposure, and issuer policies may eliminate it entirely. The strongest response is to use official contact channels, report the charge immediately, preserve a written timeline, and keep paying only the undisputed balance that remains due.
A stolen card number can be part of a larger account takeover. After the initial report, the cardholder should change the online password, enable multi-factor authentication, review authorized devices, and confirm that the mailing address, phone number, and email have not been altered. Any unfamiliar authorized user should be removed through the issuer. Credit reports should also be checked for new accounts or inquiries. A card replacement solves the compromised number but does not address identity information used elsewhere. When identity theft is suspected, an official IdentityTheft.gov recovery plan can organize reports and recovery steps, while a credit freeze can block additional misuse.
This article was researched and drafted with AI assistance and reviewed against the linked primary sources.
More Financial Reading
- The ideal retirement withdrawal rate so your savings actually last
- How many CDs can you park at 1 bank? FDIC rules you must know
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
