Debit Card Fraud: What You Owe and What to Do
A charge you don't recognize on a debit card takes real money right away. Here is what the law says about reporting fast, and what to do next.
You open your account and see a charge or withdrawal you did not make. With a debit card, that money is gone from your account right away.
Debit card fraud works differently from credit card fraud. A credit card charge is money you might pay later. A debit card charge comes out of your account at once. That is why reporting speed matters so much here.
Check your debit card charges closely
The FTC says to carefully check ATM or debit card transactions because they take money from your account right away.
Report the card as soon as you can
The FTC says to report a lost or stolen card to the bank or credit union that gave it to you. Do this as soon as you can. Do this before anything else.
The FTC says federal law does not make you pay for charges made without your OK after you report the loss.
What Regulation E says about what you owe
Regulation E is the federal rule for debit cards and other electronic transfers. It says what you owe for an unauthorized transfer depends on how fast you report a lost or stolen access device. Your card is an access device under this rule.
Regulation E sets three tiers of what you can owe for an unauthorized transfer. The faster you report, the less you can owe. The slower you report, the more you can owe. The FTC says you aren't responsible for unauthorized ATM or debit card transactions if you report the loss before someone uses it. After someone uses it, what you owe depends on how quickly you reported it.
One more thing from the rule. Regulation E also says a bank cannot use your carelessness to make you owe more than the rule allows.
Regulation E also sets conditions on the access device. Regulation E says the transfer must have used an accepted access device. Regulation E says the financial institution must have provided a means to identify the consumer to whom the access device was issued.
When the two business day clock starts
Regulation E has a two business day rule. Regulation E says the two business day rule is calculated based on two 24-hour periods, without regard to the financial institution's business hours. So the clock runs on full days, not on when the bank's lobby is open.
What if you could not report right away? Regulation E says a financial institution must extend its notice deadlines for a reasonable period when a consumer's delay was due to extenuating circumstances. Regulation E's interpretation says extended travel and hospitalization are examples of circumstances that require extending the notice periods.
How to give notice
Regulation E says a consumer may notify the institution in person, by telephone, or in writing. A phone call counts.
The rule says notice counts once you take reasonable steps to give the bank your account details. You can identify the account by the name on the account and the type of account.
There is one more path. Regulation E says notice may be considered constructively given when the institution becomes aware of circumstances suggesting an unauthorized transfer may have been made.
What if you cannot make the call yourself? The rule's reading also says someone can give notice for you. Regulation E's interpretation says notice given by a person acting on the consumer's behalf is valid. Regulation E's interpretation says a financial institution may require documentation showing that a person is acting on the consumer's behalf.
What the FTC says to do after you report
Reporting the card is the first step, not the last. The FTC says to keep checking your account statements. Report fraudulent charges right away.
The FTC says to check whether your homeowner's or renter's insurance covers you for card thefts.
Then look wider. The FTC says to check your free credit reports for accounts or charges you don't recognize. If that happened, the FTC says to visit IdentityTheft.gov. You can report the identity theft there and get a recovery plan. For fraud that goes beyond your card, see our page on bank fraud.
How to protect the account
The FTC's advice says to protect your accounts by using multi-factor authentication when it is available. For more steps, see our guide on how to prevent credit card fraud.
What federal law protects
The FTC says federal law protects you from unauthorized use of your debit card. Regulation E sets the limits on what you can owe, and reporting speed sets the tier.