How Federal Law Limits Your Liability for Unauthorized Credit Card Charges

If someone racks up charges on your stolen credit card, federal law does most of the work protecting your wallet. Under the Fair Credit Billing Act and its implementing rule, Regulation Z, your liability for unauthorized credit card use is capped at $50, and it can drop to zero depending on when you report the loss. That protection is stronger than what applies to debit cards, where the clock and the cap work differently.

The $50 cap, and how to get it to $0

The core rule is simple: if a thief uses your credit card before you report it missing, you owe at most $50 for those unauthorized charges. This isn't just informal guidance — it's written into Regulation Z, which caps a cardholder's liability at the lesser of $50 or the actual amount obtained through the unauthorized use before the issuer was notified. If you report a lost or stolen credit card before it is used, you owe nothing for any unauthorized charges that follow.

That lesser-of standard matters: if only $30 in charges went through before you called your issuer, you owe $30, not the full $50. In practice, many card issuers voluntarily go further and waive the $50 entirely, so a lot of cardholders end up owing nothing even in a late-report scenario, though that extra protection comes from the cardholder agreement rather than federal law itself. The FDIC's own consumer guidance backs this up, noting that losses may be limited to $50 as long as you notify your issuer promptly. The bigger win comes from acting before any fraud happens: if you report a card lost or stolen before it's ever used without authorization, you cannot be held responsible for any of the unauthorized charges that follow, not even the $50. The FDIC's guidance similarly notes that you may not be responsible for any charges if you report your loss before your credit card is used.

Your 60-day window to dispute charges

Separate from the liability cap, the Fair Credit Billing Act gives you 60 days from the date a billing statement is sent to dispute billing errors over $50, including charges you didn't authorize. This is a procedural deadline for formally challenging a charge on your statement, distinct from the notification that triggers the $50 liability cap under Regulation Z. In plain terms: notifying your issuer that a card is lost or stolen caps what you owe, and separately, disputing a specific charge you spot on a statement has its own 60-day clock. It's worth reviewing statements as soon as they arrive so you don't lose track of that window.

Worked example: a $500 unauthorized charge

Say a thief steals your credit card and uses it to make a single $500 purchase before you notice it's gone, an amount that falls under the unauthorized-use liability cap in Regulation Z. Once you report the card lost or stolen, your liability for that $500 charge is capped at the lesser of $50 or the amount obtained before you notified the issuer, so you owe at most $50. Many issuer agreements waive even that $50, but the federal floor stops the charge from being your problem at all beyond that ceiling. If instead you had noticed the card missing and reported it before the thief ever used it, that same $500 charge would never have occurred as your liability, since a report made before use eliminates responsibility for unauthorized charges entirely.

• amount before notice: 500
• liability cap: 50
• Formula: amount before notice - liability cap
• Result: 450

A $500 unauthorized charge reported promptly leaves the cardholder owing at most $50 under Regulation Z.

Why debit cards work differently

Debit cards fall under a separate federal framework, the Electronic Fund Transfer Act and its implementing rule, Regulation E, which sets a very different timeline for protection. If you notify your bank within two business days after learning your debit card is lost or stolen, your liability is capped at the lesser of $50 or the actual amount of unauthorized transfers that occurred before you gave notice. Wait longer than that, and the exposure grows fast: if an unauthorized transfer shows up on a statement and you don't notify your bank within 60 calendar days after that statement was sent, you can face unlimited liability for unauthorized transfers made after that 60-day window closes. That later, open-ended exposure has no equivalent for credit cards, where liability for unauthorized use before the card is reported missing tops out at $50; for debit cards, the unlimited-liability rule applies only to transfers made after the 60-day reporting window closes, and only when a periodic statement actually showed the unauthorized transfer, so protection for transfers that happened before that 60-day cutoff is not erased by a later delay.

Credit card versus debit card liability rules

Factor	Credit card (Regulation Z)	Debit card (Regulation E)
Liability if reported before any unauthorized use	$0	Not addressed in the cited rule for pre-use reports
Liability if reported promptly after unauthorized use	Lesser of $50 or amount used before notice	Lesser of $50 or amount of unauthorized transfers if reported within two business days of learning of loss
Liability if reporting is delayed	Still governed by the same $50-or-less cap tied to amount obtained before notice	Unlimited liability possible for transfers occurring after a 60-day window, but only if a periodic statement showed an unauthorized transfer and the cardholder failed to notify the institution within 60 calendar days after that statement was sent
Separate dispute deadline for billing errors	60 days from the date the billing statement is sent, for errors over $50	Not addressed in the cited rule

Comparing how federal law caps liability for lost or stolen credit cards versus debit cards.

1. Call your card issuer's fraud or customer service line as soon as you notice the card is missing or see a charge you don't recognize, since a report made before any unauthorized use means you owe nothing under federal law.
2. If unauthorized charges already occurred, notify the issuer promptly anyway, since your liability is capped at the lesser of $50 or the amount used before you notified them.
3. Follow up in writing and note the date, since you have 60 days from when a billing statement is sent to formally dispute charges over $50, including unauthorized ones.
4. For a debit card, notify your bank within two business days of learning it's lost or stolen to keep your liability capped at $50 or less.
5. Review debit card statements within 60 days of when they're sent, since waiting longer can expose you to unlimited liability for transfers made after that window.

Key takeaways

• Report a lost or stolen credit card before it's used and you owe nothing for unauthorized charges that follow.
• If unauthorized use happens first, Regulation Z caps your liability at the lesser of $50 or the amount taken before you notified the issuer.
• Many issuer agreements waive the $50 entirely, though that's a policy choice on top of the federal floor.
• You separately have 60 days from a billing statement's send date to dispute certain billing errors over $50, including unauthorized transactions.
• Debit cards follow Regulation E, not the credit card rules, and the $50-or-less cap only applies if you notify your bank within two business days after learning of the loss or theft.
• If an unauthorized transfer shows up on a periodic statement and you don't notify your bank within 60 days after that statement was sent, you can face unlimited liability for transfers made after that 60-day period.

Frequently asked questions

Does it matter which card network I use, like whether it's a major card brand?

The claims here describe federal law under the Fair Credit Billing Act and Regulation Z, which caps liability at $50 or less regardless of network, and that cap applies to credit cardholders under open-end consumer credit plans generally.

What if I don't notice the unauthorized charge for a few months?

For credit cards, your liability is still capped at the lesser of $50 or the amount used before you notified the issuer, so delay in noticing does not by itself increase that cap. However, separately, the Fair Credit Billing Act gives you 60 days from when the billing statement showing that charge was sent to dispute certain billing errors over $50, including unauthorized charges, and missing that window can complicate resolving the dispute.

Is the debit card rule really that much worse than the credit card rule?

It can be, depending on timing. A debit cardholder who notifies the bank within two business days of learning of a loss or theft keeps the same $50-or-less cap credit cardholders get. But if an unauthorized transfer appears on a statement and the consumer doesn't notify the bank within 60 calendar days after that statement was sent, liability becomes unlimited for transfers after that period, a risk that doesn't have an equivalent stated for credit cards in these rules.

Do I need to prove I reported the card missing?

The rules key the liability cap to when you notify the issuer or financial institution, not to a separate proof step described in these sources: for credit cards, notice to the issuer cuts off further liability under Regulation Z, while for debit cards the cap depends on notifying the bank within two business days of learning of the loss or theft, or facing unlimited liability if an unauthorized transfer isn't reported within 60 days of the statement showing it.

Does the $50 cap apply per card or per unauthorized transaction?

The cited rule describes the cap as the lesser of $50 or the amount obtained through unauthorized use before notification, framed around the unauthorized use following a lost or stolen card rather than per individual transaction.

The single most protective move under these rules is reporting a lost or stolen credit card before any unauthorized use happens, since that eliminates your liability entirely, rather than merely capping it at $50. For more on resolving disputes once a charge appears, see [How to Dispute a Credit Card Charge](https://www.bestcreditcare.com/how-to-dispute-a-credit-card-charge).

Sources

• www.fdic.gov
• www.consumerfinance.gov
• www.consumerfinance.gov
• www.consumerfinance.gov