My debit card was used fraudulently — what are my rights?
Report to your bank within 2 business days of discovering the fraud for maximum protection. The Electronic Funds Transfer Act limits your liability based on how quickly you report.
Last reviewed: 10 June 2026
Explanation
Debit card fraud protection in the U.S. is governed by the Electronic Funds Transfer Act (EFTA) and Regulation E. Unlike credit cards (which use the FCBA and limit your liability to $50), debit card liability depends heavily on how quickly you report the problem. This makes prompt reporting critically important.
If you report within 2 business days of learning about the unauthorized use, your maximum liability is $50. Between 2 and 60 days after the statement is sent showing the fraudulent charge, the limit rises to $500. If you wait more than 60 days after the statement, you could lose everything charged after that 60-day window — including funds added to the account after the statement date.
Call your bank's fraud line immediately upon discovering any unauthorized charge. Ask the bank to cancel your current card and issue a new one with a different number. Request that they reverse all unauthorized charges during the investigation period. Banks typically issue provisional credit within a few business days while the investigation is ongoing.
If your bank denies the claim or fails to credit your account, file a complaint with the Consumer Financial Protection Bureau (CFPB). The CFPB routes complaints directly to the bank and requires a formal response, which often prompts reconsideration. Many banks voluntarily apply the more consumer-friendly credit card rules to debit card fraud even though they are not legally required to do so.
Common red flags
- Small test transaction from an unknown merchant followed by a larger charge
- ATM skimmer: card reader or PIN cover that feels loose or looks unusual
- Charge from a merchant in a city or country you have not visited
- Online charge for a subscription you never signed up for
- Multiple small charges from the same merchant in rapid succession
What to do now
- Call your bank's fraud line immediately — report within 2 business days for full protection
- Ask the bank to cancel your card and issue a new number
- Request provisional credit while the investigation is open
- Review all recent transactions and report every unauthorized charge
- File a complaint with the CFPB if the bank does not cooperate
- Enable real-time transaction notifications on your account
Frequently asked questions
Does the 2-business-day rule apply from when the fraud happened or when I noticed?
The 2-business-day clock starts from when you learn about the unauthorized transaction — not necessarily when it occurred. This means checking your account regularly is important, since you cannot benefit from a protection window you did not know to use.
Why is debit card protection weaker than credit card protection?
Credit cards use your credit line — fraud means disputing a debt. Debit cards use your actual bank funds — fraud means your money is already gone. Credit card issuers also benefit from strong consumer protection laws that give them incentive to protect users.