When something shows up on a credit card statement that you don’t recognize, the bank’s money is on the line while it gets sorted out. A debit card is different. The money left your checking account the moment the charge went through, and until the dispute is settled, you’re the one waiting to get it back.
That’s why the rules behind debit card disputes matter more than most people realize. They come from a federal regulation called Regulation E, which implements the Electronic Fund Transfer Act. It sets out exactly how long your bank has to investigate, when it has to put money back in your account temporarily, and how much of a fraud loss you can be stuck with. With holiday shopping in full swing, this is the season when those rules get tested the most.
What Regulation E covers, and what it doesn’t
Regulation E applies to electronic fund transfers, which is a broad category. According to Bankrate’s overview of Regulation E, it covers debit card purchases whether you sign or enter a PIN, ATM withdrawals and deposits, direct deposits, ACH transfers and automatic bill payments, phone and online bank transfers, and person-to-person payments like Zelle when the transfer was unauthorized.
The exclusions are just as important. Credit cards fall under a different rule, Regulation Z. Wire transfers follow their own rules. Paper checks aren’t covered, even if you deposited one with your phone. And payments you authorized yourself, even if a scammer talked you into them, sit in a gray area where Regulation E may not help.
There’s another limit that catches people off guard. The regulation’s list of “errors” covers things like transfers you didn’t authorize, transfers for the wrong amount, transfers missing from your statement, math mistakes by the bank, and getting the wrong amount of cash from an ATM. It doesn’t include a merchant who took your money and never shipped the sweater. Some banks and card networks will still try to help with that kind of dispute, but it depends on their own policies, not on Regulation E’s deadlines.
The 60-day window to report a problem
Your clock starts with your bank statement. Under 12 CFR 1005.11, you have to tell your bank about an error no later than 60 days after it sends the periodic statement where the error first appeared.
You can usually report by phone. The bank is allowed to ask you to follow up in writing within 10 business days, but if it does, it has to tell you so when you call and give you the address. If you report by phone and skip the written follow-up the bank asked for, the bank’s obligation to give you a temporary credit can go away (more on that below), so don’t skip it.
The 10-business-day investigation
Once the bank gets your notice, it has 10 business days to investigate and decide whether an error happened. If it finds one, it has to correct it within one business day of that decision. Either way, it has to tell you the results within three business days after finishing the investigation.
Ten business days is two calendar weeks. That’s tight, and banks often can’t finish complicated cases that fast, especially when a merchant or another bank is involved. So the rule gives them more time, but only if they do something for you in return.
How provisional credit works
If the bank needs longer than 10 business days, it can take up to 45 days total. The condition is that it has to provisionally credit your account for the disputed amount, including any interest, within those first 10 business days. It also has to tell you how much it credited and when, within two business days of doing so.
Provisional credit is the part of Regulation E that matters most to your budget. It means that even if your case drags on for six weeks, you have your money back and can use it while the bank investigates. For someone whose rent payment depends on that checking account balance, getting $600 back in week two instead of week six makes a big difference.
There’s one exception worth knowing. For suspected unauthorized transfers, the bank can hold back up to $50 of the provisional credit. That lines up with the $50 liability cap described below.
When the clock runs longer
Some situations get extra time. If the transaction happened within 30 days after the first deposit into a brand-new account, the initial investigation window stretches from 10 business days to 20. And the 45-day outer limit becomes 90 days for point-of-sale debit card transactions, for transfers that weren’t initiated within a state (including foreign transactions), and for transfers on new accounts.
That 90-day rule for point-of-sale purchases is easy to overlook. A disputed charge from a store checkout or an online order paid with your debit card can legally take three months to resolve. You’d still get provisional credit in the meantime if the bank takes more than 10 business days, but it’s a long wait for a final answer.
What happens if the bank says no
If the bank decides there was no error, or a different one than you claimed, it can take back the provisional credit. But it has to tell you the date and amount of the reversal first. Then, for five business days after that notice, it has to keep honoring checks, drafts, and preauthorized payments to third parties that it would have paid if the credit had still been there, and it can’t charge you overdraft fees on them. That buffer exists so a reversal doesn’t set off a chain of bounced payments.
How much of a fraud loss can land on you
Separate from the dispute timeline, Regulation E caps what you owe when someone uses your card without permission. Under 12 CFR 1005.6, as published by the Consumer Financial Protection Bureau, if you report a lost or stolen card within two business days of learning it’s gone, your liability is capped at $50 or the amount of the unauthorized transfers before you reported it, whichever is less.
Wait longer than two business days and the cap rises to as much as $500. Miss the 60-day window after your statement shows the unauthorized transfers, and you can be liable for later transfers the bank shows wouldn’t have happened if you’d reported on time. The official interpretation says that can mean unlimited liability. The bank has to extend these deadlines to a reasonable period if something like extended travel or a hospital stay kept you from reporting.
In practice, many banks and card networks promise zero liability for debit card fraud through their own policies, which is better than the law requires. The federal caps are the floor, and they reward speed.
What this means for how you use your debit card
The rules are fairly strong, but they’re built around your own quickness. The 60-day reporting window and the two-business-day fraud cap both assume you’re looking at your account. Turning on transaction alerts and checking your balance a couple of times a week costs nothing and keeps you inside the best protections.
The structure also explains why some people put holiday shopping and online orders on a credit card and keep the debit card for groceries and ATM runs. With a credit card, a disputed charge never touched your checking account in the first place. With a debit card, you’re relying on provisional credit to get your money back while the bank investigates, and you’ll want a cushion in savings in case it takes a while.
If your bank misses these deadlines or won’t investigate, you can file a complaint with the CFPB. Knowing the exact timelines (60 days, 10 business days, 45 or 90 days) makes that conversation with your bank a lot shorter.
