The simple version

Credit card fraud is governed by one federal rule, Regulation Z, which implements the Truth in Lending Act. Debit card fraud is governed by a different one, Regulation E, which implements the Electronic Fund Transfer Act.

The difference is not cosmetic. Under the credit card rule your maximum liability for unauthorized use is a fixed $50. Under the debit card rule it depends on how quickly you report, and it climbs in steps the longer you wait.

The numbers

• Regulation Z provides that liability for unauthorized use of a credit card shall not exceed the lesser of $50 or the amount obtained by the unauthorized use before notification to the issuer (12 CFR 1026.12(b))
• That $50 applies per account rather than per card, and a series of unauthorized uses cannot exceed it (Regulation Z official commentary)
• Under Regulation E, reporting within two business days of learning of the loss or theft caps liability at the lesser of $50 or the amount of unauthorized transfers before notice (12 CFR 1005.6(b))
• Failing to report within two business days raises the cap to the lesser of $500 or a sum the rule defines, covering transfers the institution establishes would not have happened had you reported in time (12 CFR 1005.6(b))
• An unauthorized transfer appearing on a periodic statement must be reported within 60 days of the institution transmitting that statement. Past that, liability for later transfers is not held to the $500 ceiling (12 CFR 1005.6(b))
• The Federal Trade Commission states the debit tiers plainly: $0 before any unauthorized charges are made, $50 within two business days, $500 after that but within 60 calendar days of the statement being sent, and beyond 60 days all the money taken from the account and possibly money in linked accounts (Federal Trade Commission)
• An institution generally has 10 business days to investigate an alleged error, or up to 45 days if it provisionally credits the account within 10 business days. New accounts, point-of-sale debit, and foreign-initiated transfers extend those to 20 business days and 90 days (12 CFR 1005.11)
• Under Regulation Z a billing error notice must arrive no later than 60 days after the creditor transmitted the first statement showing the error, and the consumer need not pay the disputed amount while it is investigated (12 CFR 1026.13)
• Neither rule is a floor on protection. No agreement may impose greater liability than Regulation E allows, and many issuers voluntarily provide more protection than the minimum (12 CFR 1005.6 official interpretation)

Whose money is missing while you wait

The liability caps get the attention, and there is a second difference that matters more in practice. It is about which account the disputed money sits in during the investigation.

A fraudulent credit card charge is a charge against a line of credit. No money has left an account of yours, and Regulation Z says you need not pay the disputed amount while it is being investigated. The money in question is the issuer's exposure rather than your cash.

A fraudulent debit card transaction is a withdrawal. The money is gone from your checking account the moment it clears, and getting it back means waiting for the investigation or for provisional credit. Rent does not wait for that, and neither does an automatic bill.

That is why two rules with the same headline number can produce very different weeks. The cap describes what you might ultimately lose. It says nothing about what you can spend on Tuesday.

The clock is the part people get wrong

The debit rule's tiers are built around when you report, and the starting points are easy to misread. One clock runs from when you learn the card or credentials were lost or stolen. Another runs from when your statement was transmitted, which may be well before you opened it.

Neither clock runs from the moment the fraud happened, which is the assumption most people make. That is why the rule effectively rewards reading statements rather than reacting to a discovery, and why exposure grows on accounts nobody checks.

One qualifier belongs alongside all of it, and it cuts in the consumer's favor. These regulations set a ceiling on how much liability can be placed on you, not a description of what your account actually offers. No agreement may impose more liability than Regulation E permits, many issuers voluntarily provide more protection than the law requires, and your cardholder agreement is the document that says which.

The Real Cost lens on one thousand dollars

Run the same fraud through both rules. The $1,000 is a stated illustration and the caps are the statutory maximums confirmed above.

• On a credit card: statutory maximum liability $50, and none of the $1,000 ever left a bank account. Under Regulation Z you need not pay the disputed amount while it is investigated
• On a debit card reported within two business days: statutory cap $50, so up to $950 comes back, but the full $1,000 left your checking account first and you wait for it
• On a debit card reported after two business days but within 60 days of the statement: cap $500, so the arithmetic on the same theft changes by $450
• Reported more than 60 days after the statement was sent: the $500 ceiling no longer holds for the later transfers, and exposure can reach the full amount and money in linked accounts

The pattern is worth carrying even without the numbers in front of you. One rule sets a fixed ceiling. The other sets a ceiling that rises with delay, by a factor of ten between the first tier and the second.

What this means

The useful thing to know in advance is that these are two separate legal regimes with two separate clocks, and that your own account agreement may provide more than either requires. Both are readable before anything goes wrong, which is the only time anyone reads them calmly.

If something has already gone wrong, the Consumer Financial Protection Bureau publishes plain-language guidance on both rules and operates a complaint process. What to do in a specific situation depends on facts an article cannot see.

What this is NOT

This is not legal advice and it is not guidance on disputing a charge, filing a claim, or dealing with a bank, all of which depend on your agreement, your circumstances, and rules that can change. Those belong with the Consumer Financial Protection Bureau's complaint process, a legal aid organization, or an attorney. This is not advice about which payment method to use, and this article does not recommend a debit card, a credit card, or any product for any purpose. This is not a recommendation of any bank, issuer, network, or card, and no institution is described as safer than another. This is not a claim that any institution handles disputes improperly, because the differences described here are written into federal regulations. Many issuers provide protection exceeding the statutory minimum and your agreement governs. The dollar figures in the illustration are stated examples. This is not investment or financial advice of any kind.

Sources

• Consumer Financial Protection Bureau, Regulation Z, 12 CFR 1026.12, Special credit card provisions (the $50 cap on liability for unauthorized use): https://www.consumerfinance.gov/rules-policy/regulations/1026/12/
• Consumer Financial Protection Bureau, Regulation Z, 12 CFR 1026.13, Billing error resolution (the 60-day notice window and the right not to pay the disputed amount): https://www.consumerfinance.gov/rules-policy/regulations/1026/13/
• Consumer Financial Protection Bureau, Regulation E, 12 CFR 1005.6, Liability of consumer for unauthorized transfers (the two-business-day and 60-day tiers, and the limit on what any agreement may impose): https://www.consumerfinance.gov/rules-policy/regulations/1005/6/
• Consumer Financial Protection Bureau, Regulation E, 12 CFR 1005.11, Procedures for resolving errors (the 10-business-day investigation, provisional credit, and the extensions): https://www.consumerfinance.gov/rules-policy/regulations/1005/11/
• Federal Trade Commission, Lost or Stolen Credit, ATM, and Debit Cards (the tiers in plain language): https://consumer.ftc.gov/articles/lost-or-stolen-credit-atm-and-debit-cards