Lost or Stolen Debit Card: What You Can Owe and How Fast to Report

Published by the Modern Lending Solutions editorial team. Last reviewed: October 30, 2026.

Short answer: under federal Regulation E, how much you can owe for unauthorized use of a lost or stolen debit card depends on how fast you tell your bank or credit union. Report within two business days after you learn of the loss and your limit is $50 or less. Report later and it can reach $500. And if you do not report an unauthorized transfer within 60 days after the statement that shows it is sent, you can owe for later transfers with no dollar cap. Report right away, by phone and in writing. This is general information, not legal or financial advice.

What counts as unauthorized

An unauthorized electronic fund transfer is one from your account “initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit” (12 CFR 1005.2(m), eCFR, text up to date as of October 28, 2026, read October 30, 2026). It does not include transfers by someone you gave your card or code to, until you tell the institution that person is no longer allowed, or transfers you or someone working with you made with fraudulent intent. A card, code or other means of access is an “access device” (1005.2(a)(1)), so the same rules cover a stolen PIN.

The CFPB lists ATM transactions, debit card purchases, some online bill payments and automatic payments as electronic fund transfers (CFPB, last reviewed August 28, 2026, read October 30, 2026). A credit card follows different rules: see unauthorized credit card charges.

The three tiers

The official interpretation says: “There are three possible tiers of consumer liability for unauthorized EFTs depending on the situation”, and “More than one tier may apply to a given situation” (comment 6(b)-1, Supplement I).

When you report	Your limit (12 CFR 1005.6(b))
Within two business days after you learn of the loss or theft	The lesser of $50 or the unauthorized transfers before you report (1005.6(b)(1))
After those two business days	The lesser of $500 or: up to $50 of transfers in the two business days, plus transfers after them and before you report that the institution shows would not have happened if you had reported in time (1005.6(b)(2))
More than 60 days after the institution sends a statement showing an unauthorized transfer	Transfers after the 60 days and before you report that the institution shows would not have happened, with no dollar cap, plus the amounts above if a card or code was used (1005.6(b)(3))

Source: 12 CFR 1005.6(b), eCFR, text up to date as of October 28, 2026, read October 30, 2026. The CFPB’s plain version says that after two business days “you could be responsible for up to $500 in unauthorized transactions” (CFPB).

If money leaves your account without your card or code, for example by an electronic debit you never allowed, the first two tiers do not apply. You owe nothing if you report within 60 days after the statement showing it is sent; after that, you may owe for transfers made after the 60 days and before you report (comment 6(b)(3)-2).

How the two business days are counted

The two business days do not include the day you learn of the loss or any day that is not a business day, and they run as two 24-hour periods, “without regard to the financial institution’s business hours” (comment 6(b)(1)-3). They start when you learn of the loss, not when the card was lost. Getting a statement that shows unauthorized transfers “may be a factor” in deciding when you knew, but is not conclusive proof (comment 6(b)(1)-2).

Things that do not raise your limit

Carelessness: “Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E”. The comment gives writing the PIN on the card or on paper kept with it as an example that does not change your liability (comment 6(b)-2).
Your account agreement: “no agreement between the consumer and an institution may impose greater liability on the consumer” than Regulation E allows (comment 6(b)-3).
A lower limit elsewhere: if the law where you live or your agreement sets less liability, the lower amount applies (1005.6(b)(6)).

The CFPB still advises: “Never write your PIN on your debit card or keep it written down in your wallet” (CFPB).

Extra time for travel or a hospital stay

If your delay “was due to extenuating circumstances, the institution shall extend the times specified above to a reasonable period” (1005.6(b)(4)). The official examples are “the consumer’s extended travel or hospitalization” (comment 6(b)(4)-1). Someone acting for you can give notice, for example while you are in the hospital, and the institution may ask for papers showing they act for you (comment 6(b)(5)-2).

How to give notice

You may notify the institution “in person, by telephone, or in writing” (1005.6(b)(5)(ii)).
Written notice counts as given when you mail it or send it by another usual means (1005.6(b)(5)(iii)).
Notice given in a reasonable manner counts even if you use a different address or phone number than the one the institution named (comment 6(b)(5)-1).
If you do not know the card or account number, notice still works if you identify the account well enough, for example by the name on it and the type of account (comment 6(b)(5)-3).

Write down the date, time and the name of the person you spoke with, and follow up in writing.

Worked examples by report date, only for the math

These examples are only for the math. The dates and amounts are example figures, and they follow the pattern of the official example in comment 6(b)(2)-1. Say your card is stolen and you learn of it on Monday, November 2, 2026. The two business days are Tuesday, November 3, 2026 and Wednesday, November 4, 2026, so they end at 11:59 p.m. on Wednesday, November 4, 2026. A thief takes $100 on Tuesday, November 3, 2026 and $600 on Friday, November 6, 2026.

You report on	Transfers before you report	Your limit	Math
Wednesday, November 4, 2026	$100	$50	Lesser of $50 or $100 (1005.6(b)(1)); the $600 has not happened yet
Thursday, November 5, 2026	$100	$50	Two business days have passed, but only $50 of the $100 counts and nothing happened after them before you reported (1005.6(b)(2))
Monday, November 9, 2026	$700	$500	$50 of the $100, plus $600 = $650, capped at $500, if the institution shows the $600 would not have happened had you reported in time

If the order were reversed, $600 on Tuesday, November 3, 2026 and $100 on Friday, November 6, 2026, a report on Monday, November 9, 2026 would leave you liable for no more than $50 + $100 = $150, the result the official example gives for that order.

The 60-day rule, also only for the math: if a statement showing an unauthorized transfer is sent on Monday, November 30, 2026, the 60 days end on Friday, January 29, 2027. Transfers after that date and before you report can be charged to you with no dollar cap, if the institution shows they would not have happened had you reported in time (1005.6(b)(3)).

Getting the money back: the error resolution timeline

An unauthorized transfer is an “error” under 12 CFR 1005.11(a)(1)(i) (eCFR). Your notice must reach the institution no later than 60 days after it sends the statement where the error first shows, and must let it identify your name and account and say why you think there is an error (1005.11(b)(1)). If you report by phone, it may ask you to confirm in writing within 10 business days and must tell you where to send it (1005.11(b)(2)).

The institution must investigate and decide within 10 business days, report to you within three business days after it finishes, and correct an error within one business day after it finds one (1005.11(c)(1)).
It may take up to 45 days if it provisionally credits your account within 10 business days, tells you within two business days after the credit, and gives you full use of the money while it investigates (1005.11(c)(2)). For an unauthorized transfer it may hold back no more than $50 of the credit.
The time is 90 days instead of 45 for a point-of-sale debit card transaction, a transfer within 30 days after the first deposit to a new account, and a transfer not started within the U.S.; for the new-account case, 20 business days replace 10 (1005.11(c)(3)).
If it finds no error, it must explain in writing, tell you that you can ask for the documents it relied on, and, before taking back a provisional credit, honor checks and preauthorized payments for five business days without overdraft charges from the reversal (1005.11(d)).

A timeline example, only for the math: if your notice reaches the institution on Monday, November 9, 2026, 10 business days end on Tuesday, November 24, 2026 (November 11 is not a business day). If it provisionally credits you, 45 days end on Thursday, December 24, 2026, or Sunday, February 7, 2027 for a point-of-sale debit card transaction. The CFPB gives the same 10, one and three business day steps (CFPB).

Steps right away

Call the institution as soon as you know, and lock or cancel the card if you can.
Follow up in writing and keep a copy.
Read every statement when it arrives and report anything wrong within 60 days.
Change your PIN and online banking password.
If automatic loan payments come from the account, see how to stop automatic loan payments to move them.

If someone tricked you into giving them card details, see fake loan text and call scams. If you think the institution did not follow these rules, see how to file a loan complaint.

Questions to ask your bank or credit union

What date and time do you have for my report?
Do you need written confirmation, and where do I send it?
Will you provisionally credit my account, and when?
Does my account agreement set a lower liability limit than Regulation E?

Checklist

Report within two business days after you learn of the loss: $50 or less.
Later, the limit can reach $500.
Check statements: after 60 days there is no dollar cap on later transfers.
Ask for more time if travel or a hospital stay delayed you.
Keep a record of every call and letter.

Start your loan request How our service works

Sources

Disclosure: Modern Lending Solutions is not a lender, loan broker or agent for any lender or loan broker, and does not make credit decisions. Any compensation we receive is paid by participating lenders, only for advertising services. This guide is general information, not financial or legal advice.

Lost or Stolen Debit Card: Your Liability Depends on When You Report