Short answer: for a credit card, federal law caps what you can owe for charges someone else made without your permission at $50, or less if less was charged before you told the issuer. If only your card number was used, for example in an online or phone order, the official interpretation says you owe nothing for it. Debit cards follow different rules with higher limits, so report a lost card or a strange charge right away either way. This is general information, not legal or financial advice.
The $50 limit for credit cards
The Truth in Lending Act says a cardholder is liable for unauthorized use of a credit card only if all of these conditions are met: the card is an accepted card, “the liability is not in excess of $50”, the issuer gave adequate notice of the liability and a way to report loss or theft, the use happened before the issuer was notified, and the issuer gave a way to identify the person allowed to use the card (15 U.S.C. 1643(a)(1), official U.S. Code text, read October 30, 2026). “Except as provided in this section, a cardholder incurs no liability from the unauthorized use of a credit card” (1643(d)). If the issuer goes to court to collect, it has to prove the use was authorized, or that the conditions were met (1643(b)).
Regulation Z says the same: your liability “shall not exceed the lesser of $50 or the amount of money, property, labor, or services obtained by the unauthorized use before notification to the card issuer” (12 CFR 1026.12(b)(1)(ii), eCFR, text up to date as of October 28, 2026, read October 30, 2026). If the law where you live or your card agreement sets a lower amount, the lower amount applies (1026.12(b)(4)). An issuer does not have to charge you anything at all for unauthorized use (Official Interpretation, comment 12(b)-2, read October 30, 2026).
What counts as unauthorized use
Unauthorized use is “the use of a credit card by a person, other than the cardholder, who does not have actual, implied, or apparent authority for such use, and from which the cardholder receives no benefit” (1026.12(b)(1)(i)). The official interpretation adds:
- A card taken from you by fraud or robbery counts (comment 12(b)(1)(ii)-4).
- If you let someone, such as a family member or coworker, use your card and they go beyond what you allowed, you are liable for those charges unless you had told the issuer that their use was no longer allowed (comment 12(b)(1)(ii)-3).
- If the card itself was not presented, for example an online or phone order placed with only the card number, expiration date and security code, “no liability may be imposed on the cardholder” (comment 12(b)(2)(iii)-3).
- A convenience check that draws on your card account is not covered by the $50 rule, but the billing error rules do apply to it (comment 12(b)-4). See credit card convenience checks.
How to tell the issuer
You may notify the issuer “in person, by telephone, or in writing”, and notice counts once you have taken the steps reasonably needed to give it the facts, even if no particular employee receives it (12 CFR 1026.12(b)(3)). A written notice counts when it is received or, received or not, when the time normally needed to deliver it has passed, whichever is earlier. If the issuer wants to charge you anything, it must investigate your claim reasonably; it “may not automatically deny a claim based solely on the cardholder’s failure or refusal” to give a particular item, such as a police report, and it cannot require a statement under penalty of perjury (comment 12(b)-3).
Cards you never asked for
“No credit card shall be issued to any person except” in response to an oral or written request or application, or as a renewal of or substitute for a card you already accepted (12 CFR 1026.12(a)). The $50 rule also applies only to an accepted card (1026.12(b)(2)(i)). If a card arrives that you never asked for, contact the issuer and check your credit reports; see check your credit report before a loan and credit freeze and loan applications.
Debit cards follow different limits
A debit card draws on your bank account and is covered by Regulation E, not by the credit card rule. Its limits depend on how fast you report (12 CFR 1005.6(b), eCFR, text up to date as of October 28, 2026, read October 30, 2026):
| When you report | Your limit under Regulation E |
|---|---|
| Within two business days after you learn the card was lost or stolen | The lesser of $50 or the transfers before notice (1005.6(b)(1)) |
| After two business days | Up to $500: the lesser of $50 or the transfers in those two business days, plus later transfers before notice that the bank shows would not have happened if you had reported in time (1005.6(b)(2)) |
| More than 60 days after the bank sends a statement showing the transfer | Transfers after those 60 days and before notice that the bank shows would not have happened, with no dollar cap in the rule, plus the amounts above if a card was used (1005.6(b)(3)) |
If your delay in telling the bank “was due to extenuating circumstances”, the bank must extend these times to a reasonable period (1005.6(b)(4)). If the law where you live or your agreement sets less liability, the lower amount applies (1005.6(b)(6)). For more on Regulation E timing, see how to stop automatic loan payments.
An $800 example, only for the math
This example is only for the math, and the amounts are example figures. Someone uses your lost card for $800.00 in charges before you report it: $300.00 within two business days after you learn of the loss, and $500.00 after that.
| Card | Your limit | How |
|---|---|---|
| Credit card, charges made with the card | $50.00 | The lesser of $50 or $800.00 (1026.12(b)(1)(ii)) |
| Credit card, card number used online only | $0.00 | Card not presented (comment 12(b)(2)(iii)-3) |
| Debit card, reported within two business days | $50.00 | The lesser of $50 or $300.00 (1005.6(b)(1)) |
| Debit card, reported later | $500.00 | $50.00 + $500.00 = $550.00, capped at $500.00, if the bank shows the later $500.00 would not have happened (1005.6(b)(2)) |
Unauthorized use vs a billing dispute
A charge you did not make is also a billing error you can dispute in writing within 60 days after the first statement that shows it, under 12 CFR 1026.13. A charge you made but disagree with, such as goods that never arrived, is a dispute, not unauthorized use. For both, see credit card billing error dispute.
Questions to ask the issuer or bank
- Will you charge me anything for these charges, and under which rule?
- What information do you need from me for your investigation?
- When will the charges be removed from my balance, and will interest or fees on them be reversed?
- Is a new card number being issued, and what happens to my automatic payments?
Checklist
- Report a lost or stolen card, or a charge you did not make, right away, by phone or online.
- Write down the date, time and the name of anyone you spoke to.
- Send a written billing error notice within 60 days of the statement.
- Check every statement for charges you do not know.
- For a debit card, report within two business days of learning of the loss.
- Check your credit reports if a card you never asked for arrives.
Start your loan request How our service works
Sources
- 15 U.S.C. 1643, Liability of holder of credit card (Truth in Lending Act), official text from the U.S. Code on GovInfo (2024 edition)
- eCFR: 12 CFR 1026.12, Special credit card provisions (Regulation Z), current text up to date as of October 28, 2026
- CFPB: Comment for 1026.12, Special Credit Card Provisions (Official Interpretation, Supplement I to Part 1026)
- eCFR: 12 CFR 1026.13, Billing error resolution (Regulation Z), current text up to date as of October 28, 2026
- eCFR: 12 CFR 1005.6, Liability of consumer for unauthorized transfers (Regulation E), current text up to date as of October 28, 2026
Disclosure: Modern Lending Solutions is not a lender, loan broker or agent for any lender or loan broker, and does not make credit decisions. Any compensation we receive is paid by participating lenders, only for advertising services. This guide is general information, not financial or legal advice.