Last reviewed: 6 October 2026
Home › Credit help › Unauthorized credit vs. debit charges
Unauthorized charges: how credit card and debit card protections differ
Two different federal rules apply. For a credit card, Regulation Z limits your liability for unauthorized use to the lesser of $50 or what the thief obtained before you notify the issuer.[1] For a debit card or other electronic transfer from your bank account, Regulation E sets $50 and $500 tiers that run from learning of the loss or theft of the access device, and a separate 60-day rule for transfers that appear on a statement, with no fixed dollar cap on transfers after that window.[2] This page puts the two side by side. It reports the rules; it does not recommend a card.
The short version
- Credit card: liability for unauthorized use may not exceed the lesser of $50 or the money, property, labor or services obtained by the unauthorized use before you notify the issuer.[1]
- Debit card and other electronic transfers, lost or stolen access device: the tiers run from when you learn of the loss or theft. Notify within two business days and liability is capped at the lesser of $50 or the unauthorized transfers before notice. Otherwise it is capped at the lesser of $500 or a sum described in the rule.[2]
- The 60-day rule: for any unauthorized electronic transfer that appears on a periodic statement, including one with no lost or stolen device, the rule requires a report within 60 days of the statement being sent to avoid liability for later transfers.[2]
- Better terms by agreement: under both rules, if state law or your agreement with the issuer or bank imposes less liability, the lesser amount governs.[1][2]
Side by side
| Credit card (Regulation Z) | Debit card or account transfer (Regulation E) | |
|---|---|---|
| What counts as unauthorized | Use of the card by a person other than the cardholder who has no actual, implied or apparent authority, and from which the cardholder receives no benefit.[1] | An electronic fund transfer from your account started by a person other than you without actual authority, and from which you receive no benefit. The definition has listed exclusions.[3] |
| Cap on what you can owe | The lesser of $50 or the money, property, labor or services obtained by the unauthorized use before you notify the issuer.[1] | Where the access device is lost or stolen. Notice within two business days after learning of the loss or theft: the lesser of $50 or the unauthorized transfers before notice. Otherwise: the lesser of $500 or $50 (or the unauthorized transfers within the two business days, if less) plus later transfers the institution shows would not have occurred with timely notice.[2] |
| Transfers shown on a statement | Not a separate step in the liability section. The billing error process has its own 60-day window (below).[1][4] | You must report an unauthorized transfer on a periodic statement within 60 days of the statement being sent. If you do not, your liability for transfers after those 60 days is the amount of unauthorized transfers that the institution establishes would not have occurred had you notified it within the 60 days. This is the operative limit when no lost or stolen device is involved. Where an access device is involved, the $50 and $500 amounts may also apply.[2] |
| When you can be held liable at all | Only if the card is an accepted credit card, the issuer gave adequate notice of your maximum potential liability and how to report a loss, and the issuer provided a means to identify the cardholder or authorized user.[1] | Only if the institution gave the required disclosures. If an access device was involved, it must be an accepted access device and the institution must have provided a means to identify the person it was issued to.[2] |
| How you can notify | In person, by telephone or in writing. Notice is given when you take the steps reasonably required in the ordinary course of business, whether or not a particular employee receives it.[1] | In person, by telephone or in writing. Written notice is considered given when you mail it or deliver it for transmission by any other usual means.[2] |
| Late notice for good reason | The section does not say.[1] | If a delay was due to extenuating circumstances, the institution must extend the time limits to a reasonable period.[2] |
What happens after you report
| Credit card (billing error) | Debit card (error resolution) | |
|---|---|---|
| Is it covered? | A “billing error” includes a charge on a statement for credit not made to you or to a person with actual, implied or apparent authority to use your card.[4] | An “error” includes an unauthorized electronic fund transfer.[5] |
| Your notice | Must be in writing and reach the creditor at the address shown on the statement no later than 60 days after it sent the first statement showing the error. It must identify your name and account number and, where possible, say why you believe there is an error and its type, date and amount.[4] | May be oral or written, received no later than 60 days after the institution sends the statement showing the error. The institution may require written confirmation within 10 business days of an oral notice, if it tells you so.[5] |
| Timeline | The creditor must acknowledge in writing within 30 days, and resolve the matter within two complete billing cycles, and in no event later than 90 days.[4] | The institution must determine whether an error occurred within 10 business days. If it needs longer, it may take up to 45 days if it provisionally credits your account within 10 business days. It must report results within three business days after finishing and correct an error within one business day after determining it occurred. Longer periods apply in the cases below.[5] |
| Money during the investigation | See our guide to disputing a credit card charge for what the issuer must and must not do while it investigates. | With a provisional credit, you get full use of the funds during the investigation. If the institution has a reasonable basis to believe a transfer was unauthorized and has met the disclosure condition, it may withhold up to $50 from the credit.[5] |
Regulation E extends these periods in some cases. The 10 business days becomes 20 business days if the error involves a transfer to or from the account within 30 days after the first deposit to the account. The 45 days becomes 90 days if the transfer was not initiated within a state, resulted from a point-of-sale debit card transaction, or occurred within 30 days after the first deposit.[5]
What these rules do not cover
- They set a legal floor. Card networks and banks may offer more under their own policies, and the rules say a lower liability set by state law or agreement governs.[1][2]
- The credit card liability section lets a card issuer and an organization that has 10 or more cards issued to its employees agree to different liability, with limits on charging an employee.[1]
- The pages used here do not say which cards or accounts a given bank treats as covered, or how a particular transaction would be classified. Ask your issuer or bank, and see our guide to stopping automatic payments if the transfers are recurring.
- They are a summary of the regulation text, not the full rule. This page is general information, not legal advice. Our Standard checks companies; it does not review any card or bank.
Your next step
The rules above turn on when and how you notify the issuer or bank: a credit card billing-error dispute needs a written notice; a bank accepts oral notice but may require written confirmation within 10 business days. A record of the date, method and content of each notice shows when you notified. If a company will not fix it, see where to file a credit, debt or scam complaint. If the account was opened or used by an identity thief, see blocking fraudulent information from your credit report. To check a company that offers credit help, use the Register and our guide to checking a company yourself.
When we will update this page
We revisit it when the cited regulation sections change. Sources last read 6 October 2026.
What you can do next
- Find a company — see which specific US companies we checked and what we could verify.
- How we check — the rules and sources behind each result.
- More credit help guides
- Report an error on this page or in a result.