Two business days is the line that decides how much a stolen debit card can cost. Report it inside that window and a cardholder’s federal liability is capped at $50, but wait longer and the exposure climbs, according to the Consumer Financial Protection Bureau’s text of Regulation E.
That timing rule is one of six debit card habits that consumer agencies and advocacy groups say to avoid. The list below draws on the CFPB, the Federal Trade Commission and Consumer Action, with each item tied to its source.
1. Never Wait to Report a Lost or Stolen Card
Regulation E sets tiers. Notice within two business days caps liability at the lesser of $50 or the unauthorized transfers made before notice. Notice after that is capped at $500, as long as the rule’s other conditions are met, per section 1005.6 of the rule. The two days start the day after a cardholder learns of the loss, and weekends and holidays do not count.
The Federal Trade Commission puts it plainly: report a missing card right away, by phone or through the issuer’s mobile app, because waiting until someone uses it can mean paying some or all of the charges. A card reported before any unauthorized charges leaves the owner at $0. Readers who also carry cards in a wallet can see what else belongs in 10 things that should never be kept in a wallet, and a lost card on a trip is one of the travel blunders that turn a vacation into a stress fest. Frenz Hub’s guide to travel accessories is a handy companion for trip planning, and bank-impersonation calls are covered in 8 things a bank will never ask customers to do on a phone call.
2. Never Ignore the Monthly Statement
Under Regulation E, an unauthorized transfer that shows up on a statement must be reported within 60 days of the bank sending that statement. Miss that and the cardholder can be on the hook for later transfers the bank shows would have been prevented by timely notice, according to the CFPB. The agency’s text adds an exception: if extenuating circumstances such as extended travel or hospitalization delayed notice, the bank must extend the time limits to a reasonable period. Holiday shoppers can find more cautions in 6 things never to do when shopping online this holiday season.
The FTC says debit transactions deserve frequent checks because they draw money out of the account immediately. For purchases made with only the card number, the agency says the owner is not responsible for unauthorized transactions if the report comes within 60 calendar days after the statement was sent. Denied claims do happen, as in the story of Bank of America customers whose unauthorized debit card claims were denied, while Frenz Hub’s list of common regrets in adulthood collects other lessons learned the hard way.
3. Never Write the PIN on the Card or Keep It in the Wallet
The FTC says an ATM or debit PIN should not be kept in a wallet, purse or pocket, and should never be written on the card or on any paper that could be lost or seen. A card and its code stored together hand a thief the whole set.
One nuance from the CFPB’s official commentary: under Regulation E, negligence such as writing a PIN on the card does not increase a consumer’s liability, which depends only on how promptly a loss is reported. That makes quick reporting the bigger protection, but a thief with both card and PIN can still drain an account before the report is made. Frenz Hub keeps a list of common choices in life that are actually really bad for those who like cautionary lists.
4. Never Give Account Details on a Call Someone Else Started
The FTC advises sharing account information only when the cardholder placed the call and knows why it is needed. The agency also warns that legitimate companies do not call about “credit card loss protection,” that no one should pay for it, and that account numbers should not go to anyone claiming to be from a “security department.” The FTC points readers to ReportFraud.ftc.gov to report scams.
5. Never Carry More Cards Than Needed
Among the FTC’s protection tips is to carry only the cards that are needed, since every extra card is one more thing that can go missing. The agency also suggests turning on multi-factor authentication where it is offered, keeping receipts and deposit slips safe, and shredding old cards by cutting through the account number, magnetic strip and security code, with the pieces thrown away in separate bags. For chip cards, it suggests smashing the chip with a hammer.
6. Never Skip the Follow-Up and the Proof
After reporting a loss by phone or app, the FTC recommends sending a letter to the card issuer with the account number, when the card was noticed missing and when it was first reported, and keeping a copy of the letter and call notes. For fraudulent charges on a debit card, the letter goes to the errors address and confirms the report with relevant dates and times.
Consumer Action notes that if a bank follows the reporting guidelines it must provide provisional credit for the disputed amounts, but without sufficient proof that the card was used fraudulently, a cardholder could be liable for the entire disputed amount. Consumer Action also says some issuers offer voluntary “zero liability” protection that goes beyond the federal floor, so the issuer’s terms are worth checking.
Get stories like this by email. Sign up for Crafting Your Home.
This article was produced with AI assistance and edited for accuracy against the sources linked above.
Image: Elph – CC BY-SA 3.0/Wikimedia Commons
