Unauthorized Debit Card Transaction: Which Deadline Applies?

By Iqbal Azizpoor · Published October 15, 2026

Sources reviewed October 15, 2026 · Editorial Policy

You spot money missing from a checking account. Maybe your debit card is gone. Maybe the card is still in your wallet. Maybe an impostor got your login code. Or maybe a scammer persuaded you to send the payment yourself.

Those facts matter. The two-business-day rule and the 60-day rule do not apply in the same way to every situation.

Quick answer

Report the transaction to your bank or credit union immediately, using a trusted number or its official app. Then describe exactly what happened: what was lost, who initiated the transfer, when you noticed it, and when the statement was sent.

The two-business-day rule is not a universal deadline for every suspicious debit.

It is especially important when you discover that a debit card or other access device, such as a PIN or security code, was lost or stolen. If the card and access information were not lost or stolen and you first see an unauthorized transfer on a statement, the statement-based 60-day rule is central.

These rules can limit liability for an unauthorized electronic fund transfer. They do not promise an instant or permanent refund. The bank must investigate, and the facts determine whether a transfer was unauthorized.

Regulation E generally covers electronic fund transfers involving a consumer account used mainly for personal, family, or household purposes. Credit card charges, business accounts, paper checks, and certain wire-transfer systems follow different rules. Payment-app transactions depend on how the transfer and account are structured.

Start with what happened

1. Your card, PIN, or other access information was lost or stolen

Notify the bank within two business days after you learn of the loss or theft. Under Regulation E, timely notice can limit your liability to the lesser of $50 or the unauthorized transfers that occurred before notice.

If you wait longer than two business days, your possible liability can rise to as much as $500 when the bank establishes that later transfers would not have happened if you had reported on time. A separate 60-day statement rule can also matter if unauthorized transfers continue.

2. The card is still with you, but an unauthorized transaction appears

You may notice a debit card purchase, ATM withdrawal, online transfer, or automatic debit you did not make or allow. If no card or access device was lost or stolen, the first two liability tiers tied to a lost or stolen access device generally do not apply.

The 60-day clock generally runs from when the statement showing the unauthorized transfer was sent—not from the transaction date.

Report before that period ends. If you wait longer, the bank may be able to hold you responsible for later unauthorized transfers made after the 60-day period and before your notice. It must show that timely notice would have prevented those later transfers. The rule is not a promise that every transaction reported within 60 days will be refunded, and it is not a simple rule that every older transaction is automatically lost.

Two federal provisions use 60 days for different purposes. Section 1005.11 generally requires notice within 60 days after the statement first showing the error was sent to trigger Regulation E’s error-resolution procedures. Section 1005.6 addresses possible liability for later unauthorized transfers when notice comes after that period.

3. A fraudster got your credentials, then initiated the transfer

A thief may obtain login details, a one-time code, or debit card information through hacking, phishing, or impersonation. The CFPB says a transfer initiated by a fraudster can still be an unauthorized electronic fund transfer when the fraudster obtained access information through fraud—even if the consumer was tricked into revealing it.

Do not assume that sharing a code ends all federal protection. Also do not hide how the code was obtained. Give the bank the complete sequence: who contacted you, what you shared, who pressed the final transfer button, and when you discovered the transaction.

4. You personally sent the payment after a scammer deceived you

This is different from a fraudster using stolen credentials to move the money. The U.S. Government Accountability Office reports that financial institutions generally are not required under federal law to reimburse a fraudulently induced payment when a person with payment authority personally authorized it.

Still report it immediately. Ask the bank, card issuer, or payment service to stop or reverse the payment and ask what voluntary protections may apply. Also report the scam to the Federal Trade Commission. Speed can matter even when federal reimbursement is not guaranteed.

Report the exact sequence; do not guess which legal label applies.

What to do first

Secure access. Lock the card if the app allows it. Change compromised passwords and PINs. Ask whether the account number or card should be replaced. Do not assume that locking a card reports the disputed transaction. Separately notify the institution through its stated fraud or error-reporting channel.
Contact the institution now. Use the number on the card, statement, or official website. State the amount, date, merchant or recipient, and why you say the transfer was unauthorized or scam-related.
Record the notice. Save the time, channel, representative, case number, and any promise or deadline. Keep screenshots and statements without sending passwords or full account numbers by insecure email.
Follow written-confirmation instructions. A bank may ask for written confirmation after an oral report. If it requires this and you do not provide it within ten business days, it may not have to give temporary credit during the investigation.
Watch for more transfers. Review the full account, linked payment apps, automatic debits, and recent statements. Report each unfamiliar item. Consider the broader steps in Finlitera’s Identity Theft & Credit Freezes lesson if personal information was exposed.

How the investigation generally works

After the bank or credit union receives notice of an error, Regulation E generally requires a prompt investigation. CFPB guidance summarizes the usual timeline this way:

The institution generally has ten business days to investigate. The initial period can be 20 business days for an account open fewer than 30 days.
If it cannot finish in that period, it generally must provide temporary credit for the disputed amount, minus up to $50, while it continues. Written-confirmation requirements and other exceptions can affect temporary credit.
The usual extended investigation limit is 45 days. It can be as long as 90 days for certain foreign transactions, debit card point-of-sale purchases, or transfers involving a new account.
When the institution finds an error, it must correct it within one business day. It must report the investigation result within three business days after completing the investigation.

Temporary credit is not a final decision. If the bank later determines that the transfer was authorized, it can remove the temporary credit after giving the required notice. You may request the information the institution used to reach its conclusion.

The bank must begin a Regulation E investigation after receiving an oral or written error notice. CFPB compliance guidance says it cannot require you to contact the merchant or file a police report before it starts. A police report can still be useful in an identity-theft case, but it is not the trigger for the bank’s investigation duty.

Worked examples

Lost card

Maya realizes on Monday evening that her debit card is missing. On Tuesday, she sees an ATM withdrawal she did not make and calls the bank. Because she reported within two business days after discovering the loss, the lower liability tier may apply. The bank still investigates whether the withdrawal was unauthorized.

Card still present

Eli still has his card and PIN. A statement sent September 30 shows an unfamiliar online debit. He reports it on October 10. The two-business-day lost-card rule is not the main clock on these facts. The statement-based 60-day period matters, and reporting promptly helps prevent more transfers.

Credentials obtained through impersonation

Nora gives a one-time code to someone pretending to be her bank. The fraudster then logs in and initiates a transfer. CFPB guidance says an access device obtained through fraud can produce an unauthorized transfer. Nora reports the exact sequence instead of describing it only as “a scam.”

Payment personally sent

Devon uses a payment app to send money after an impostor claims that the payment will protect his account. Devon personally approves the transfer. Federal law generally does not require reimbursement for a fraudulently induced payment that an authorized account user sent, but Devon reports it at once and asks the bank and app to stop or recover the funds.

These examples explain the questions to ask. They do not predict the result of a real claim.

Common mistakes

Waiting for the monthly statement when you already know a card or PIN was lost
Treating two business days as the deadline for every unauthorized transaction
Treating 60 days as a guaranteed refund window or as a universal chargeback period
Calling every scam payment “unauthorized” without explaining who initiated it
Assuming temporary credit is final
Using a number supplied in a suspicious text instead of a trusted contact channel

Finlitera’s Financial Scams lesson explains common pressure and impersonation tactics. The Digital Money lesson covers safer use of cards, payment apps, and online banking.

Frequently asked questions

Does the two-business-day rule apply if my card is still in my wallet?

Not automatically. That rule is tied to learning that an access device was lost or stolen. If you still have the card and did not lose a PIN or other access information, the statement-based 60-day rule may be the more relevant federal timing rule. Report immediately either way.

Is the 60-day period measured from the transaction date?

Regulation E generally measures it from when the financial institution sends the periodic statement showing the transfer.

Can the bank make me contact the merchant first?

CFPB compliance guidance says a financial institution must begin its investigation after receiving an error notice and cannot require merchant contact as a condition of starting it.

Does temporary credit mean I won?

No. Temporary credit gives access to funds while an extended investigation continues. It can be reversed if the bank later concludes that the transfer was authorized, subject to required notice.

What if I personally sent money to a scammer?

Report it immediately and ask the bank or payment service to stop or reverse the payment. But a payment you personally authorized is generally treated differently under federal law from a transfer a fraudster initiated with stolen or fraudulently obtained access. Recovery is not guaranteed.

Bottom line

Move fast, but start with the facts. Say whether the card or access information was lost, whether someone else initiated the transfer, and when the statement was sent. The two-business-day and 60-day rules protect different parts of the problem. A clear report gives the bank the information it needs to investigate and helps preserve the protections that may apply.

Official Sources

This article provides general financial and consumer-law education for a U.S. audience. It is not individualized financial or legal advice. Regulation E coverage, liability, error-resolution rights, and voluntary protections depend on the transaction, account, timing, institution, and facts. Report suspected fraud promptly and consider qualified legal help for a disputed or high-value claim.