Quick answer: If someone uses your credit card without permission, federal law caps your loss at $50, and most card networks offer $0 liability. For a debit card, the cap depends on speed: $50 if you report within 2 business days of learning about the loss, up to $500 after that, and possibly everything if you wait more than 60 days after your statement is sent. Report it to your bank right away.
Holiday shopping season is peak time for card fraud. The rules that protect you come from two federal laws: the Fair Credit Billing Act for credit cards and the Electronic Fund Transfer Act for debit cards. Here’s how each works, what to do first, and how to get your money back.
Credit card vs. debit card fraud liability
| Situation | Credit card | Debit card / ATM card |
|---|---|---|
| Card number stolen, card still in your wallet | $0 | $0 if you report within 60 days of the statement showing the charge |
| Card lost or stolen, reported within 2 business days | Max $50 | Max $50 |
| Card lost or stolen, reported after 2 business days but within 60 days of statement | Max $50 | Max $500 |
| Reported more than 60 days after statement was sent | Max $50 | Possibly all money taken after the 60 days |
Based on the Fair Credit Billing Act and the Electronic Fund Transfer Act (Regulation E), as explained by the FTC.
Visa, Mastercard, American Express and Discover all advertise zero-liability policies for eligible fraud. These are card network promises on top of the law, and they have conditions, so read your card’s terms.
What to do right now: step by step
- Lock or freeze the card in your bank or card app. This stops new charges in seconds.
- Call the number on the back of the card (or on your statement). Say the charges are unauthorized and ask for a new card number.
- Write down the date, time and the rep’s name. The clock for your liability runs from when you report.
- Follow up in writing if the bank asks, or if it’s a credit card billing error. Keep copies.
- Check other accounts. Change passwords, turn on two-factor login, and update any autopay that used the old card.
- Report identity theft at IdentityTheft.gov if someone also opened accounts in your name.
- Watch for the provisional credit (see below) and the bank’s final answer.
How fast will you get your money back?
Debit cards
Under Regulation E, your bank generally has 10 business days to investigate after you report an error. If it needs longer, it can take up to 45 days (90 days for some cases, such as new accounts, foreign transactions or point-of-sale purchases), but it must give you a provisional credit within the 10 business days so you can use your money while it looks into it.
Credit cards
For billing errors, you should send a written dispute so the card issuer gets it within 60 days after the first statement with the error was mailed. The issuer must acknowledge it within 30 days and resolve it within two billing cycles (no more than 90 days). You don’t have to pay the disputed amount while it’s being investigated.
For a simple unauthorized charge, most issuers handle it by phone and remove the charge quickly.
Made-up examples (for illustration):
Jasmine sees a $640 charge at an electronics store she’s never visited. Her credit card is still in her wallet, so the thief only had the number. She locks the card and calls the issuer that night. The charge is removed, and she owes $0.
Derek loses his wallet on a Friday but doesn’t notice until the next Thursday, after $900 is taken from checking with his debit card. Because he reported after 2 business days but within 60 days of his statement, his loss could be up to $500. Many banks cover more under their own policies, but the law only guarantees the $500 cap.
Also read: How to dispute a credit card charge and win
Why credit cards are safer for shopping
With a debit card, the thief spends your money. Rent and bills can bounce while you wait for the bank to finish. With a credit card, the fraud hits the bank’s money, and you don’t pay while it’s disputed.
That’s why many experts suggest using a credit card (paid in full each month) for online and holiday shopping, gas pumps and travel. Keep debit for ATM withdrawals at your own bank.
What isn’t covered
- Payments you made yourself to a scammer. If you were tricked into sending money, for example by a fake “bank” caller, banks often treat it as authorized. Report it anyway, and also to the FTC at ReportFraud.ftc.gov.
- Charges by someone you gave the card to, such as a family member, unless you told the bank they no longer have permission.
- Gift cards and some prepaid cards. Protections vary. Many gift cards have little or no fraud protection once the money is gone.
- Peer-to-peer apps like Zelle or Venmo when you sent the money yourself. Unauthorized transfers from your account are treated differently from scams where you pressed send.
How to spot card fraud early
- Turn on text or app alerts for every purchase, or for purchases over a small amount like $1.
- Check your accounts once a week, not once a month.
- Watch for small “test” charges of $1 or $2. Thieves often try a tiny charge before a big one.
- Use virtual card numbers or mobile wallets (Apple Pay, Google Pay) online and in stores. They hide your real card number.
- Avoid gas pumps or ATMs that look tampered with. Pull on the card reader; skimmers are often loose.
If the bank says no
- Ask for the decision in writing and the documents it relied on. Under Regulation E, you have the right to request them.
- Escalate inside the bank: ask for a supervisor or the bank’s complaint department.
- File a complaint with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint. Banks usually respond within 15 days.
- For smaller banks and credit unions, you can also contact their regulator, such as the NCUA for credit unions.
Quick checklist to save on your phone
- Card issuer’s fraud phone number (from the back of the card)
- Bank’s 24/7 fraud line
- Your card app login, so you can lock the card in seconds
- Date and time you first noticed the problem
- Screenshots of the suspicious charges
Take photos of the front and back of every card you carry and store them in a secure place. If your wallet is stolen, you’ll know exactly which cards to report.
Business days vs. calendar days
The 2-business-day rule for debit cards counts business days, not weekends or federal holidays. But the safest rule is simple: report it the same day you notice, even on a Saturday. Most banks have 24/7 fraud lines and app tools to lock a card at any hour.
Also note when your statement is sent. The 60-day window for debit card errors starts from the date the bank sends the statement that first shows the problem, not from when you open it. If you don’t check paper statements, switch to email or app alerts.
Recommended products
Simple tools that help protect your cards.
Disclosure: As an Amazon Associate, Nexgen Headlines earns from qualifying purchases.
FAQ
Am I responsible for fraudulent charges on my credit card?
No more than $50 under federal law, and $0 if only your card number (not the card) was stolen. Most issuers waive even the $50.
How long do I have to report debit card fraud?
Report within 2 business days of learning about a lost card to keep your loss at $50. Always report within 60 days of the statement, or you could lose everything taken after that.
Will the bank give my money back while it investigates?
For debit cards, if the bank needs more than 10 business days, it generally must give you a provisional credit within those 10 days.
Does a fraud claim hurt my credit score?
No. Reporting fraud and getting a new card number doesn’t affect your score.
What if I gave a scammer my card info myself?
Report it to your bank right away. Charges the scammer makes without your OK are usually still unauthorized, even if you were tricked into sharing the number.
Bottom line
Credit cards cap your fraud loss at $50, often $0. Debit cards protect you only if you act fast: 2 business days for the $50 cap and 60 days from your statement before you risk losing it all. Turn on alerts, lock the card the moment something looks wrong, and call your bank the same day.
Last reviewed: Nov. 11, 2026.
Sources: FTC: Lost or stolen credit, ATM and debit cards, CFPB: Regulation E §1005.6 (liability), CFPB: Regulation E §1005.11 (error resolution), CFPB: Regulation Z §1026.13 (billing errors), IdentityTheft.gov.
Featured image: Card payment terminal. Photo: Nicbou / Wikimedia Commons, CC0; edited by Nexgen Headlines.
