If your debit card is missing or you notice a transaction you did not authorize, contact your bank or credit union immediately. Debit cards draw money from your deposit account, and prompt reporting can limit further losses and help protect your legal rights.
What to do right away
- Use a trusted contact method. Call the number on your statement or the institution's verified website, or use its official app. If you still have your card, use the number on the back. Do not rely on a link or phone number in an unexpected fraud alert.
- Report the missing card or suspicious activity. Explain what happened, when you noticed it and which transactions you dispute. Also report a stolen PIN, compromised banking login or lost phone containing a payment wallet.
- Secure the card and account. If available, lock the card while contacting the institution. A lock may not stop every transaction and does not replace reporting the problem. Ask whether the card needs replacement and whether PINs, login credentials or wallet access need to be changed or disabled.
- Review recent activity. Identify other unfamiliar withdrawals or purchases. Confirm that your address, email and phone number have not been changed.
- Keep records. Save transaction details, statements, messages, the date of your report and any reference number. Ask about next steps, written-confirmation requirements and replacement-card delivery options.
Do not delay your report while gathering every document or trying to resolve suspected unauthorized use with a merchant. An oral report can start the Regulation E error-resolution process. A financial institution cannot require a police report or merchant contact before beginning an investigation of a covered error.
Understand the reporting deadlines
The following summarizes federal protections for personal debit and ATM cards linked to U.S. consumer deposit accounts. Business accounts and some other card products have different rules.
If a card, PIN or other account-access device is lost or stolen
| When you notify the institution | Potential responsibility |
|---|---|
| Before unauthorized transfers occur | No liability for those later unauthorized transfers. |
| Within two business days after learning of the loss or theft | No more than $50, and never more than the applicable unauthorized transfers. |
| After two business days | Potentially up to $500, depending on when transfers occurred and what the institution establishes timely notice would have prevented. The separate 60-day statement rule below can expose you to additional losses. |
The separate 60-day statement rule
Report unauthorized transfers within 60 calendar days after the institution sends the statement showing them. If you wait longer, you may be responsible for additional unauthorized transfers occurring after that period and before your report, if the institution establishes that timely notice would have prevented them. Those later losses can exceed $500. The delay does not automatically make you responsible for every earlier transfer.
If only your debit-card number is misused while you still have the card, reporting within that 60-day period generally protects you from liability for those unauthorized transactions. However, keeping the physical card does not eliminate the need to report a stolen PIN or other access credentials immediately; the two-business-day rule can apply to those losses.
These are general federal limits, not automatic charges. State law or your institution's policies may provide stronger protection. Qualifying circumstances, such as hospitalization that prevents timely notice, can require extensions. Report a problem even if you think a deadline has passed.
Follow up and understand the investigation
Your institution must investigate a covered error promptly. If it asks you to confirm an oral report in writing, follow its instructions and make sure the confirmation reaches it within 10 business days after your oral error report. Keep a copy. Missing a requested written confirmation can affect temporary credit, but the institution must still investigate; it cannot wait for that confirmation to begin.
- Initial investigation: Generally, the institution has 10 business days after receiving your error notice to determine whether an error occurred. For a transfer within 30 days after the account's first deposit, this period can be 20 business days.
- Temporary credit: If more time is needed, the institution generally must provide provisional credit within the applicable initial period while investigating, subject to regulatory exceptions. In qualifying cases, up to $50 may be withheld from that credit.
- Longer investigations: The usual maximum is 45 calendar days from receipt of the notice. It can be 90 days for certain transactions, including debit-card purchases, qualifying new-account transfers and transfers initiated outside the United States.
- Results: The institution generally must correct an error within one business day after determining it occurred and report its findings within three business days after completing the investigation. If it finds no error, you can request the documents it relied on.
Provisional credit is temporary. It can be reversed under the required procedures if the investigation does not support the claim. Keep monitoring your balance and ask the institution to explain any decision you do not understand.
If a criminal tricked you into revealing account credentials and then initiated transfers without actual authority, those transfers can qualify as unauthorized under Regulation E. Sharing information because of deception does not automatically eliminate your protections. Explain accurately who initiated each payment and what happened.
Ten ways to use your debit card more safely
- Monitor transactions and available funds. Review activity frequently and read each statement. Enable purchase, withdrawal and low-balance alerts when offered. Even small unfamiliar transactions deserve attention.
- Use trusted websites and devices. Research unfamiliar sellers and use a verified site or app. HTTPS encrypts the connection but does not prove a seller is legitimate. Avoid entering banking information on shared or public computers.
- Protect access. Use long, unique passwords, a reputable password manager and multifactor authentication. Keep devices updated. Do not share your PIN or give passwords or verification codes to someone who contacts you.
- Use chip or contactless payment when available. These methods help reduce certain counterfeit-card risks compared with magnetic-stripe transactions. They do not prevent every scam or unauthorized payment.
- Inspect readers and cover the keypad. Avoid loose, damaged or unusual equipment. Some skimmers are hidden, so a normal appearance is not a guarantee. If an ATM keeps your card, contact the institution promptly.
- Ask about authorization holds. Hotels, rental companies and fuel stations may reserve more than the final purchase amount, reducing your available balance. Ask how much will be held and when release is expected. A hold disappearing does not necessarily mean the final charge was canceled.
- Compare purchase protections. Before a major or delayed-delivery purchase, review refund and cancellation terms and the protections offered by your payment method. Selecting “credit” with a debit card does not turn it into a credit card; the money still comes from your deposit account.
- Keep purchase records. Save receipts, order confirmations and promised delivery dates. Check the final amount, including tips. Report incorrect amounts, duplicate debits or other problems promptly.
- Manage recurring payments. Track subscriptions and cancel unwanted services directly with the company. Ask your institution about revoking payment authorization or stopping future payments. Replacing or locking a card alone may not stop recurring charges or end a contract.
- Plan for card replacement or travel. Keep the institution's contact information securely accessible. Check legitimate automatic payments after a replacement and ask about travel settings or restrictions before leaving.
Distinguish fraud from a purchase dispute
A purchase you authorized but never received, or a disagreement about product quality, is different from someone making a payment without your permission. Your issuer or card network may offer purchase-dispute options, but reimbursement is not automatic. Incorrect amounts and duplicate debits can also qualify as errors. Describe the problem accurately and contact your institution promptly.