2026 banking guide
Bank Won’t Refund an Unauthorized Debit Card Charge? What Regulation E Requires
A denied or stalled debit card claim is often not the end of it. Federal Regulation E caps what you can lose, sets deadlines the bank must meet, and requires paperwork when it says no.
Written and fact-checked by Money You’re Owed against the primary sources linked in this guide. Last fact-checked: October 5, 2026
How much can you be made to pay?
Two clocks decide your share. One starts when you learn the card is lost or stolen. The other starts when the bank sends the statement that first shows the unauthorized transfer.
| Situation | Most you can be charged |
|---|---|
| Lost or stolen card, reported within 2 business days of learning of it | The lesser of $50 or the amount taken before notice |
| Lost or stolen card, reported later | The lesser of $500 or: up to $50 from the first 2 business days, plus later charges the bank proves timely notice would have stopped |
| Not reported within 60 days of the statement being sent | Also transfers after day 60 and before notice, if the bank shows timely notice would have stopped them |
| No card or other access device used (for example, an unauthorized ACH debit) | The $50 and $500 tiers do not apply; only the 60-day rule does |
| State law or your account agreement sets a lower limit | The lower amount |
Sources: CFPB: 12 CFR 1005.6; CFPB: Official Interpretation of 1005.6
Getting a statement does not prove you knew about the theft. It can be a factor, but not conclusive evidence. Source: CFPB: Official Interpretation of 1005.6
If extenuating circumstances caused your delay, the bank must extend these deadlines to a reasonable period. You can give notice in person, by phone or in writing, and a written notice counts on the day you mail it. Source: CFPB: 12 CFR 1005.6
Mailed vs. received
The mailing-date rule belongs to the liability section. The bank’s investigation duties apply to a notice it receives within 60 days after sending the statement. Calling first, then confirming in writing, covers both. Source: CFPB: 12 CFR 1005.11
Worked example: the same theft reported Tuesday vs. Friday
Your debit card is stolen. You discover it on Monday, June 1, 2026. The thief makes a $300 point-of-sale purchase on Tuesday, June 2 and a $700 purchase on Thursday, June 4. With no holiday that week, your 2 business days are Tuesday and Wednesday.
| Step | Case A: report Tue, Jun 2 | Case B: report Fri, Jun 5 | Case B, bank can’t prove |
|---|---|---|---|
| Taken before notice | $300 (card blocked, no Thursday charge) | $300 + $700 = $1,000 | $300 + $700 = $1,000 |
| Part (i): first 2 business days | Lesser of $50 or $300 = $50 | Lesser of $50 or $300 = $50 | Lesser of $50 or $300 = $50 |
| Part (ii): after the window | None | $700 (bank proves it was preventable) | $0 (bank cannot prove it) |
| Your liability | $50 | Lesser of $500 or $750 = $500 | Lesser of $500 or $50 = $50 |
| Bank owes you back | $300 minus $50 = $250 | $1,000 minus $500 = $500 | $1,000 minus $50 = $950 |
Source: CFPB: 12 CFR 1005.6(b)(1) and (b)(2)
Case B matches the CFPB’s official example: learn Monday, report Friday, a $100 Tuesday charge and a $600 Thursday charge. Liability is $500, which is $50 of the $100 plus $450 of the $600. Source: CFPB: Official Interpretation of 1005.6
The third column matters after a denial. The $700 counts against you only if the bank establishes a Wednesday call would have stopped it. In a lawsuit over your liability, the bank must prove the transfer was authorized. Sources: CFPB: 12 CFR 1005.6; Cornell LII: 15 U.S.C. 1693g
Case C: an ACH debit with no card involved
A $200 unauthorized ACH debit appears on a statement sent Wednesday, July 1, 2026. No card was used, so the $50 and $500 tiers do not apply. July 1 plus 60 calendar days is Sunday, August 30, 2026. Report by then and your liability is $0, so the full $200 comes back. Later debits made after August 30 and before you report can become your loss if the bank shows timely notice would have stopped them. Sources: CFPB: Official Interpretation of 1005.6; CFPB: 12 CFR 1005.6
How long does the bank have to investigate?
The bank must start investigating on your phone call. It cannot wait for a written follow-up. Source: CFPB: Official Interpretation of 1005.11 After that, it must do one of these:
- Decide within 10 business days of receiving your notice, or 20 business days if the transfer happened within 30 days of the first deposit to a new account. Sources: CFPB: 12 CFR 1005.11(c); CFPB: Ask CFPB
- Or provisionally credit you within those 10 business days (20 for a new account), holding back at most $50, and take up to 45 days. Debit card point-of-sale purchases, foreign transactions and transfers within 30 days of account opening can take up to 90 days. Sources: Cornell LII: 12 CFR 1005.11; CFPB: Ask CFPB
- Tell you about any provisional credit within 2 business days, with its amount and date, and give you full use of the money. Source: CFPB: 12 CFR 1005.11(c)
One exception: the bank can require written confirmation within 10 business days of your call, if it tells you so and gives the address during the call. If it never receives that confirmation, it does not have to provisionally credit you. Sources: CFPB: 12 CFR 1005.11(b); Cornell LII: 12 CFR 1005.11
Common denial reasons, checked against the rule
| Bank’s reason | What the rule says |
|---|---|
| “File a police report first.” | The bank cannot delay the investigation pending information from you. Source: CFPB: EFT FAQs |
| “Your PIN was written on the card.” | Negligence cannot raise your liability above the Regulation E caps. Source: CFPB: EFT FAQs |
| “You gave the caller your account details.” | Transfers after a scammer fraudulently induces you to share account access information are unauthorized. Source: CFPB: EFT FAQs |
| “Your statement showed it, so you knew.” | A statement is a factor, not conclusive proof. Source: CFPB: Interpretation of 1005.6 |
| “You reported after 60 days.” | The formal investigation steps may not apply, but 1005.6 still limits your liability. Sources: CFPB: Interpretation of 1005.11; CFPB: Interpretation of 1005.6; CFPB: 1005.6 |
| “You gave that person your card.” | This one can hold up, unless you told the bank that person was no longer authorized. Source: CFPB: 12 CFR 1005.2 |
Regulation E defines an unauthorized transfer as one started by someone other than you, without actual authority, that gives you no benefit. A payment you sent yourself, even to a scammer, does not fit that definition on its face. Source: CFPB: 12 CFR 1005.2
If the whole account was frozen rather than debited, that is a different problem. See our guide to escalating a frozen Chime or Cash App account.
Got a denial? Ask for the documents and reply in writing
If the bank finds no error, it must send a written explanation within 3 business days of concluding and tell you that you can request the documents it relied on. Ask, and it must promptly send copies. Sources: Cornell LII: 15 U.S.C. 1693f; CFPB: 12 CFR 1005.11(d)
Before taking back provisional credit, it must notify you in writing. Source: CFPB: Ask CFPB It must then honor your checks and preauthorized payments without overdraft charges for 5 business days. Source: CFPB: 12 CFR 1005.11(d)
Free letter outline
- Your name, the last 4 digits of the account, and the claim number.
- Each disputed transfer: date, amount, merchant or payee.
- The date you learned of the loss, and the date and method of your first notice.
- A request under 12 CFR 1005.11(d)(1) and 15 U.S.C. 1693f(d) for all documents the bank relied on.
- Your liability calculation under 12 CFR 1005.6, laid out like the worked example.
- A request to reopen the claim and refund everything above that amount.
Send it in a way you can prove, and keep a copy.
Dated checklist
Example dates follow Case A: you learn Monday, June 1, 2026 and call Tuesday, June 2. Swap in your own dates.
- By Wed, Jun 3: call, block the card, and log the time, agent and reference number. This keeps you in the $50 tier. Source: CFPB: 1005.6
- During the call: ask whether written confirmation is required, and where to send it. Source: CFPB: 1005.11(b)
- By Tue, Jun 16 (10 business days): send any required confirmation. The decision or provisional credit is also due. Source: CFPB: 1005.11
- Fri, Jul 17 (45 days) or Mon, Aug 31 (90 days): outer limit of the investigation; point-of-sale debit gets 90. Source: CFPB: Ask CFPB
- New account? For a transfer within 30 days of the first deposit, the bank gets 20 business days instead of 10 and 90 days instead of 45. Source: CFPB: Ask CFPB
- 3 business days after a denial decision: written explanation due. Request the documents the day it arrives. Source: Cornell LII: 1693f
- Within 60 days of each statement being sent: check for new unauthorized transfers. Source: CFPB: 1005.6
- One year from the violation: deadline to sue under the Electronic Fund Transfer Act. Source: Cornell LII: 1693m
If the bank still says no
File a free CFPB complaint. The CFPB’s June 24, 2026 changes ask consumers to dispute credit-reporting problems with the reporting agencies first. No similar step was announced for bank-account complaints, and the portal still takes them. Attach your letter, the bank’s explanation and your call log at consumerfinance.gov/complaint. Source: CFPB: June 24, 2026 announcement
Know what a court can award. Under the Electronic Fund Transfer Act, an individual can recover:
- actual damages caused by the bank’s failure;
- statutory damages of $100 to $1,000;
- costs and a reasonable attorney’s fee if the case succeeds.
The suit must be filed within one year of the violation. Source: Cornell LII: 15 U.S.C. 1693m
Treble damages apply when the bank did not provisionally credit you within 10 days and either did not investigate in good faith or had no reasonable basis to deny. They also apply to a knowing and willful denial the evidence could not reasonably support. Source: Cornell LII: 15 U.S.C. 1693f
Before paying anyone to dispute for you, compare the options in our guide to what it costs to recover money you’re owed.
Frequently asked questions
Can my bank make me file a police report before it investigates?
No. The CFPB says a bank must begin investigating promptly on your oral or written notice and may not delay starting or finishing while it waits for information from you. A police report can still help as evidence, but the bank cannot hold your claim until you file one.
How long does my bank have to investigate an unauthorized debit card charge?
Ten business days from receiving your notice, or 20 business days if the transfer happened within 30 days of the first deposit to a new account. It can take up to 45 days, or 90 days for debit card point-of-sale purchases, foreign transactions and new-account transfers, but only if it provisionally credits your account within those first 10 business days (20 for a new account).
Do I get my money back while they investigate?
Yes, if the investigation runs past 10 business days. The bank must generally credit the disputed amount, minus at most $50, and confirm it within 2 business days. The exception is when it required written confirmation of your phone report and did not receive it within 10 business days.
I was scammed into giving my login or account details. Is that still unauthorized?
The CFPB’s official FAQ says yes: transfers made after a third party fraudulently induces you to share account access information are unauthorized. A payment you started yourself is different, because the rule defines an unauthorized transfer as one started by someone other than you.
The bank says I was careless with my PIN. Does that matter?
Not for the dollar caps. Regulation E’s official commentary says negligence cannot be used to impose more liability than the regulation allows, and the CFPB applies that to a PIN written on the card. What matters is when you reported.
What if I reported after 60 days?
The bank need not follow the formal investigation timeline for a notice it receives more than 60 days after sending the statement. Your liability is still limited: the extra exposure covers transfers after the 60 days that the bank shows timely notice would have stopped. Extenuating circumstances extend the deadline to a reasonable period.
Can I sue my bank?
Yes. The Electronic Fund Transfer Act allows actual damages, $100 to $1,000 in statutory damages, and costs plus a reasonable attorney’s fee if you win. Treble damages are possible if the bank skipped provisional credit and did not investigate in good faith. You must sue within one year of the violation.