Liability for Unauthorized Credit Card Charges
Understand your rights, limits, and practical steps if someone uses your credit or debit card without your permission.
When someone uses your credit or debit card without permission, the immediate fear is that you will be stuck paying the bill. In the United States, federal law and card network policies significantly limit your financial responsibility for unauthorized charges, but those protections depend on how quickly you act and what type of card is involved.
This guide explains how liability works for unauthorized credit card and debit card transactions, the difference between card-present and card-not-present fraud, how chargebacks protect you, and the practical steps you should take if you discover suspicious activity on your account.
Key Principles of Liability for Unauthorized Card Use
The rules for liability are grounded in federal statutes and regulations. For credit cards, the primary framework is the Truth in Lending Act (TILA) and its implementing regulation, Regulation Z. For debit cards and ATM cards, the rules come from the Electronic Fund Transfer Act (EFTA) and Regulation E.
- Unauthorized use generally means the card or account is used by someone without actual, implied, or apparent authority, and you receive no benefit from the transaction.
- Federal law places caps on your liability, typically as low as $0 and never higher than $50 for most consumer credit card fraud scenarios.
- Most major card networks, such as Visa and Mastercard, voluntarily provide zero liability policies that go beyond federal minimums, meaning you usually pay nothing for fraudulent transactions when you follow the required reporting steps.
How Liability Works for Credit Card Fraud
Credit card protections are among the strongest in consumer finance. Under TILA and Regulation Z, your maximum legal liability for unauthorized use of a consumer credit card is $50, and in many cases your liability is $0.
Legal Liability Limits
Federal law sets a clear ceiling on what a card issuer can require you to pay for unauthorized credit card use.
- If you report a lost or stolen credit card before it is used, you cannot be held responsible for any unauthorized charges.
- If there is unauthorized use before you report the card missing, the most you can legally owe is $50.
- If the physical card is not lost or stolen but someone uses your account number without authorization (for example, online), you generally have no liability for those charges under federal rules.
Regulation Z defines unauthorized use for credit cards as use by a person other than the cardholder, without authority, from which the cardholder receives no benefit. Once you notify the issuer, your liability for further unauthorized activity stops at the amount incurred before notice, up to the $50 maximum.
Card Issuer Policies and Zero Liability
In practice, many card issuers go beyond the legal minimum and waive the $50 liability altogether. Major card networks have branded zero liability programs:
- Mastercard offers Zero Liability protection, promising cardholders will not be held responsible for unauthorized transactions on credit or debit Mastercards when certain conditions are met.
- Visa provides a Zero Liability Policy guaranteeing cardholders are not responsible for unauthorized charges on their Visa accounts, subject to specific limitations described by Visa.
These network policies apply in addition to federal law and are implemented by the banks that issue your card. Always review your cardholder agreement to confirm the exact scope of protection and any reporting requirements.
Disputing Unauthorized Credit Card Charges
If you spot an unfamiliar charge on your credit card statement, you have rights to dispute it under federal law. The Federal Trade Commission (FTC) provides guidance on using these rights to challenge billing errors and unauthorized transactions.
- You can dispute unauthorized charges by notifying your card issuer, typically in writing, within the time frame specified in your agreement and by law.
- While your dispute is being investigated, you may withhold payment on the disputed amount and related finance charges.
- You should continue paying the undisputed portion of your bill to avoid negative credit reporting on legitimate charges.
If the issuer concludes that the charge is valid and you disagree, you can appeal the decision within the timeframe provided and, if necessary, file a complaint with the Consumer Financial Protection Bureau (CFPB).
Liability Rules for Debit and ATM Card Fraud
For debit cards and ATM cards, the liability rules are more time-sensitive. Under the Electronic Fund Transfer Act and Regulation E, your maximum exposure ranges from $0 to unlimited, depending on how quickly you notify your bank about the loss or unauthorized transactions.
Time-Based Liability Structure
Federal law sets a tiered liability schedule when a debit or ATM card is lost or stolen and used without authorization.
| When You Notify the Bank | Maximum Liability |
|---|---|
| Before any unauthorized transactions occur | $0 |
| Within two business days after you realize the card is missing | Up to $50 |
| More than two business days after noticing loss, but within 60 days of the statement showing unauthorized withdrawals | Up to $500 |
| More than 60 days after the statement showing unauthorized withdrawals is mailed | Unlimited liability for additional transactions after day 60 |
These thresholds make prompt reporting essential. The longer you wait to notify your bank after your statement is sent, the more you risk bearing large losses for subsequent fraudulent withdrawals.
Bank Responsibilities and Additional Protections
Banks are not free to impose additional liability without justification. If a bank claims that you are liable for amounts above $50, it must demonstrate that the extra loss would not have occurred if you had provided timely notice of the card’s loss or theft.
In response to concerns about potentially unlimited liability, major card networks and some states have added further protections:
- Visa and Mastercard cap liability for unauthorized debit card transactions at $50 under their network policies, even though federal law would otherwise allow higher amounts for late reporting.
- Some states have enacted laws limiting consumers’ liability for unauthorized ATM or debit card withdrawals to $50, aligning state law with network practices.
Personal vs. Business Card Liability
The strong liability protections described above primarily apply to personal consumer accounts. Business accounts often operate under different rules. According to the Federal Deposit Insurance Corporation (FDIC), liability caps that protect consumers—such as the $50 limit for unauthorized credit card transactions—do not automatically extend to business credit and debit cards.
For business cardholders:
- Liability is typically governed by the terms of the corporate card agreement and applicable commercial law.
- Fraud policies may be less generous than consumer protections, so businesses should carefully review their contracts and implement strong internal controls.
Merchant Liability and Chargebacks
When card fraud occurs, the question of who ultimately absorbs the loss extends beyond you and your bank. The merchant that accepted the fraudulent transaction can also bear responsibility, particularly in card-not-present scenarios such as online purchases.
Card-Present vs. Card-Not-Present Fraud
| Transaction Type | Merchant Liability | Cardholder Liability |
|---|---|---|
| Card-present (in-store) | Generally limited if merchant follows card network rules and uses appropriate security (e.g., chip terminals). | Liability governed by consumer protections and issuer policies, usually $0–$50 for unauthorized credit card use. |
| Card-not-present (online, phone, mail) | Merchant typically liable for fraudulent orders; the issuing bank collects refunds from merchants via chargebacks. | Cardholder usually refunded for unauthorized charges, with liability capped or eliminated under law and zero liability programs. |
In online commerce, card networks and banks often shift liability to merchants because they cannot verify identity in person. If a transaction is later deemed fraudulent, the merchant will generally be responsible for the loss and may face higher fees or penalties if fraud levels are excessive.
Chargebacks as a Consumer Tool
A chargeback is the process by which your card issuer reverses a transaction and seeks reimbursement from the merchant’s bank. Chargebacks serve two key consumer protection functions:
- They restore funds or credit to your account for unauthorized or disputed transactions.
- They create financial incentives for merchants to maintain robust fraud prevention and honest billing practices.
Practical Steps if You Discover Unauthorized Charges
Knowing the legal limits on your liability is critical, but acting promptly is just as important. Whether the unauthorized charge appears on a credit or debit card, follow these steps to protect yourself and maximize your rights.
Immediate Actions
- Review recent activity: Carefully check your online account and most recent statements for any transactions you do not recognize.
- Contact your card issuer or bank right away: Use the phone number on the back of your card or on your statement to report the suspicious charges or lost card.
- Request card blocking and replacement: Ask the issuer to block the card or account number from further use and issue a new card with a different number.
- Document everything: Note the time and date of your call, the representative’s name, and any reference numbers provided.
Follow-Up Steps
- Submit written confirmation: For credit cards, consider sending a written dispute to preserve your rights under federal billing error rules.
- Monitor subsequent statements: Confirm that disputed charges are removed and that no new unauthorized transactions appear.
- Check your credit reports: Unauthorized card use may be a sign of identity theft. Review your credit reports to ensure no new accounts have been opened in your name.
- Consider identity theft resources: The FTC’s IdentityTheft.gov provides checklists and sample letters for responding to identity theft, including card fraud.
Frequently Asked Questions
1. Am I always protected from paying for unauthorized credit card charges?
Federal law limits your liability for unauthorized credit card use to $50, and if your card number is misused without the card being lost, you generally have no liability. Many issuers and card networks go further and offer zero liability policies, meaning you will not pay anything for fraud if you meet the reporting requirements.
2. What happens if I delay reporting a lost debit card?
If you wait more than two business days after realizing your debit card is missing, your potential liability can increase to $500, and if you fail to report unauthorized withdrawals within 60 days after your statement is mailed, you may face unlimited liability for additional fraud after that period. Reporting quickly is essential to minimize your exposure.
3. Do these protections apply to business credit and debit cards?
No. The $50 liability cap and related consumer protections generally apply to personal accounts only. Business card liability is determined by contract terms and commercial law, so companies should negotiate favorable fraud terms and maintain strong security procedures.
4. Can a merchant refuse to refund an obviously fraudulent purchase?
A merchant may initially resist a refund, but your card issuer can initiate a chargeback if it determines the transaction is unauthorized. In card-not-present environments, merchants typically bear the financial loss for fraudulent orders, while consumers receive credits or refunds.
5. Is an unfamiliar charge always fraud?
Not necessarily. Some unfamiliar charges may be legitimate, such as subscriptions, delayed postings, or charges under a different merchant name. You should first review your records and, if still unsure, contact the issuer to verify details. If neither you nor authorized users made the purchase, it is likely unauthorized and should be treated as potential fraud.
References
- Am I responsible for unauthorized charges if my credit cards are lost or stolen? — Consumer Financial Protection Bureau. 2023-05-10. https://www.consumerfinance.gov/ask-cfpb/am-i-responsible-for-unauthorized-charges-if-my-credit-cards-are-lost-or-stolen-en-29/
- Your liability for unauthorized credit and debit card charges — Anthem EAP / Legal Assist. 2022-06-01. https://www.anthemeap.com/northside-hospital/find-legal-support/resources/credit-repair-and-debt/legal-assist/your-liability-for-unauthorized-credit-and-debit-card-charges
- Using Credit Cards and Disputing Charges — Federal Trade Commission. 2023-03-01. https://consumer.ftc.gov/articles/using-credit-cards-and-disputing-charges
- An examination of the fraud liability shift in consumer card-based payment systems — Douglass, Federal Reserve Bank of Chicago. 2009-01-01. https://www.chicagofed.org/~/media/publications/economic-perspectives/2009/ep-1qtr2009-part7-douglass-pdf.pdf
- Mastercard Zero Liability Protection for Unauthorized Transactions — Mastercard. 2024-01-15. https://www.mastercard.com/us/en/personal/protection-and-security/zero-liability-protection.html
- Visa Zero Liability Policy — Visa. 2024-02-10. https://www.visa.com/en-us/personal/security/zero-liability-policy
- Will I be liable for unauthorized transactions made on business credit/debit cards? — Federal Deposit Insurance Corporation. 2023-08-01. https://ask.fdic.gov/fdicinformationandsupportcenter/s/article/Q-Will-I-be-liable-for-unauthorized-transactions-made-on-business-credit-debit-cards
Similar Articles
Read full bio of Sneha Tete
