Unauthorized charge on your debit card? Report it in 2 days

Report it fast. On a debit card, Regulation E caps your liability at $50 if you tell the bank within 2 business days of learning about the charge. Wait longer and the cap rises to $500 through 60 days after the statement. After that, losses on later transactions can be unlimited.¹

What are the liability tiers on a debit card?

Regulation E is the federal rule for electronic transfers, and it sets your maximum liability by how fast you speak up. Not by how big the charge is, and not by whether you were careless with the card. By the calendar.

Two business days is shorter than it sounds. A charge you spot on a Friday night runs its clock through Tuesday, and if Monday is a holiday you are reporting on Wednesday, already past the first tier. Report the same day you see it, before you are certain. You can withdraw a claim. You cannot rewind a deadline.

The third row is the one people misread. Unlimited does not mean the bank keeps everything. It means that once you are more than 60 days past the statement showing the first bad charge, the transactions after that point are the ones with no cap. A card left unreported for four months is a card that can be drained.

What do I do in the first hour?

Lock the card in the bank's app first. Most banks have a freeze toggle that stops new authorizations without closing the account. Fraud on a debit card is usually a series, not one charge, so this is the move that stops the bleeding while you figure out the rest.

Then pull 90 days of transactions, not 30. Test charges of a dollar or two often land weeks before the real one, and a one-month view hides them. Write down the date you found it, with the time. That date is what your 2 business days run from, and it is the fact your whole claim hangs on. List every charge you are disputing: date, exact amount, exact merchant string as printed.

If money is already gone from checking, look at what clears in the next week. A rent payment hitting a drained balance is a second problem arriving on a schedule, which is the argument for an emergency fund sized to your fixed costs sitting somewhere the card cannot reach.

Is it fraud, or is it the merchant descriptor?

Before you file, search the exact string on the statement, quotes included, city and numbers and all. Merchant descriptors are the billing names companies register, and they often have nothing to do with the sign on the storefront: a parent company, a payment processor, a franchise LLC, a name in another country because that is where the entity sits.

The other two common explanations are a free trial that converted on schedule and an annual plan renewing at a price you agreed to eleven months ago. Those are not unauthorized. Filing them as fraud can get your card reissued and your legitimate recurring payments broken. If that is what you find, the subscription audit is the faster fix: cancel at the source, then watch the next cycle.

Real signs of fraud: a charge in a city you have not been to, a card-not-present charge while the card is in your pocket, several small amounts in a row from unrelated merchants, or a charge that posts after you already reported the card compromised.

How long does the bank have to put the money back?

Once you report, the bank is on a clock too. It has 10 business days to resolve the claim or give you provisional credit while it investigates, then up to 45 days to finish, or 90 days if the account is new or the charge was point-of-sale or foreign.¹ Provisional credit is not a final ruling. If the bank later concludes the charge was authorized, it can take that credit back, so treat it as settled only when the written outcome arrives.

This is where debit and credit genuinely differ.

Read the third row twice. On debit, your rent money is the money under investigation. That is a timing problem rather than a rights problem, and it is why the two-day habit matters more here than anywhere else.

What do I say on the call, and what if they say no?

Use the word unauthorized. It is the legal term that starts the Regulation E process. "I don't recognize it" can get logged as a question instead of a claim.

"I am reporting unauthorized transactions on my debit card. I learned of them today, [date]. There are three: [date, amount, merchant], and so on. I did not authorize these. Please open a claim, give me the claim number, and confirm the date you are recording as my notification date."

Then ask three things and write down the answers: the claim number, the notification date on file, and whether the case is on the 45-day or the 90-day track. Note the representative's name and the time you called. The notification date is the fact everything hangs on, and you want to have asked about it on day one rather than reconstructing it in month two.

If the bank denies the claim, often on a thin finding like the chip was used or the address matched, ask in writing for the denial and for the documents it relied on. The request alone sometimes reopens a case. If that goes nowhere, escalate to the Consumer Financial Protection Bureau, which forwards the complaint to the company and tracks the response.³ File it with your dates, claim number, exact amounts, and names.

If the amount is large enough to change your year, or the account was drained and other payments bounced behind it, talk to someone licensed rather than working it alone. This is general information about how the timelines work, not advice about your situation.