Regulation E
Regulation E is the US federal rule that limits your liability for unauthorized debit card and electronic transfers to $50 or $500 if you report them in time.
Regulation E (12 CFR Part 1005) puts the Electronic Fund Transfer Act into practice. It covers debit card payments, ATM withdrawals, direct deposits and many person-to-person payments, and it limits what you lose when a transfer you did not authorize leaves your account.
The liability limits in section 1005.6, checked on the CFPB website on 27 September 2026:
- report a lost or stolen card or PIN within 2 business days of learning of it and you pay no more than $50;
- report later and you can lose up to $500;
- report an unauthorized transfer on your statement within 60 days of the statement being sent, or you risk unlimited liability for later transfers.
The CFPB says your bank usually has 10 business days to investigate, or up to 45 days (90 in some cases) if it gives you a provisional credit.
Example: your debit card is stolen on Friday and $900 is spent. If you tell your bank by the end of the second business day, the most you lose is $50. Wait three weeks and you could lose up to $500.
Regulation E protects unauthorized transfers; money you sent yourself to a scammer is often treated differently. Plan your next steps with the scam recovery planner.