How Federal Laws and Industry Practices Limit Losses From Cyberattacks
En Español
When criminals make unauthorized purchases using stolen payment card numbers or other information, federal consumer laws and financial industry practices protect victims from losses under certain circumstances. Here are key details to remember.
If your credit card number is accessed by cyberthieves: "Under federal law, a consumer's liability is normally capped at $50 for all unauthorized transactions on each card. However, if your credit card number is stolen, but not the card, you are not liable for any unauthorized use," said Richard Schwartz, a counsel in the FDIC's Consumer Compliance Section. "In addition, credit card losses are typically absorbed by the card issuer because of zero-liability policies, which preclude consumers from having to pay any amount of an unauthorized charge. These policies are set by the card industry."
If your debit card or the card number is used to withdraw money from a checking or savings account: To minimize your losses, you should contact your bank as soon as possible if you discover that your debit card has been lost or stolen. Your maximum liability under federal law is $50 if you notify your bank within two business days after learning of the loss or theft of your card. But if you notify your bank after those first two days, under the law you could lose more.
What if your debit card number (not the card itself) is stolen in an online hacking incident? Remember to check your account activity regularly. Timing is critical because under federal law you will not be liable for the transaction if you report it within 60 days after your account statement showing the transaction is sent to you. But if the charge goes unreported for more than 60 days, all your money in the account could be lost. However, remember to check with your bank about the payment card networks' zero-liability policy, which may protect you.
If you have a debit card for a business account that is used fraudulently: Debit cards issued for business use have different loss protections than debit cards for consumers. The Uniform Commercial Code (UCC), which sets many rules for businesses, requires a standard of "ordinary care" by the card holder in order to avoid liability for losses from online fraud. "This can be a technical area, so check with an attorney to make sure you are managing your business account consistent with the UCC rules," Schwartz advised.
If a prepaid card account is used fraudulently: Prepaid cards have money deposited onto them, and they usually aren't linked to a checking or savings account. In terms of legal protections against losses as a result of fraud, the rules vary depending on the type of prepaid card:
- Prepaid cards used by employers to pay their employees are covered under the same laws described earlier for consumer debit cards.
- General-purpose "reloadable" prepaid cards, which display a network brand such as American Express, Discover, MasterCard or Visa, currently have no protections limiting liability under federal law but do, in most cases, include in their contracts with customers the same protections as those for consumer debit cards. However, regarding liability for losses, the Consumer Financial Protection Bureau (CFPB) in November 2014 proposed a rule that would include reloadable prepaid cards under the federal law for consumer debit cards. Visit the CFPB website for updates.
- Prepaid gift cards for purchases at stores are typically not registered and, therefore, are not subject to federal consumer liability rights and protections. And, issuers of prepaid gift cards generally do not provide their own fraud liability coverage to card holders. "If you lose your gift card, you will probably lose the entire value of that card," Schwartz said.
To learn more about loss limitations under the law, search by topic at the websites of the CFPB and the Federal Trade Commission. Also be aware that FDIC deposit insurance only covers deposits if a bank fails, not for theft from bank accounts (see Dear FDIC: Questions About Deposit Insurance and Online Banking). For information about how to protect yourself from data breaches, which may involve the theft of credit or debit card information, see our Spring 2014 issue.
- Previous Story
- Table of Contents
- Next Story
The theft or loss of a credit card, debit card, or ATM card can happen to anyone—and you need to be prepared to take action, protect your rights, and stop thieves in their tracks.
If your ATM, debit, or credit card is lost or stolen, don't panic. Federal laws and bank policies limit your liability for unauthorized charges. But it's important to notify the bank or card issuer of the loss or theft as soon as you discover it.
Laws That Cover Stolen and Lost Cards
The two primary federal laws covering procedures after card theft or loss are the Fair Credit Billing Act and the Electronic Fund Transfer Act.
Reporting a Credit Card as Stolen or Lost
Under the Fair Credit Billing Act, your liability for unauthorized charges depends on whether the thief personally presented your card to make the purchase or just stole the number.
- If the thief personally presents your card to make the purchase, the card issuer can't hold you liable for more than $50 in fraudulent charges. (12 C.F.R. § 1026.12). Many card issuers waive this $50.
- You have no liability if the thief stole the number, but not the card.
However, in either of the above situations, it's important to notify the card issuer as soon as you know of the theft.
To dispute unauthorized charges, send a letter to the credit card company at the address given for this purpose, not the address for sending your payments. Include your name, address, account number, and a description of the billing error. You may use the Federal Trade Commission'ssample letter. Send your letter so that it reaches the creditor within 60 days after the first bill showing the unauthorized charge. (12 C.F.R. § 1026.13). Or you might be able to file your dispute online.
After you report your card as stolen or lost, the issuer will suspend the card and send you a new one. This is different from canceling or closing your credit cards, which can cause problems with your credit reports. The issuer will also credit back any fraudulent charges made to your account, although you can expect them to conduct a fraud investigation.
Reporting a Debit Card or ATM Card as Stolen or Lost
With ATM or debit cards, you must act quickly to avoid full liability for unauthorized charges when your card is lost or stolen. Under the federal Electronic Fund Transfer Act, your liability is:
- $0 if you report the loss or theft of the card immediately and before any unauthorized charges are made.
- up to $50 if you notify the bank within two business days after you realize the card is missing
- up to $500 if you fail to notify the bank within two business days after you realize the card is missing, but do notify the bank within 60 days after your bank statement is mailed to you listing the unauthorized withdrawals, or
- unlimited if you fail to notify the bank within 60 days after your bank statement is mailed to you listing the unauthorized withdrawals. (15 U.S. Code § 1693g).
If you can convince the bank that your notification failure was due to extenuating circumstances, it must extend the notification timeline for a "reasonable period."
Note that if the theft involved only your ATM or debit card number—and not the card—you're not liable for unauthorized transactions if you report them within 60 days after your statement is sent to you. It's important to review your statements. So, open your monthly statements promptly and compare them to your receipts.
Voluntary Caps on Liability for Debit Card Charges
In response to consumer complaints about the possibility of unlimited liability, some card issuers cap the liability on debit cards at $50. And some banks don't charge anything if unauthorized withdrawals appear on your statement.
Also, some states have capped the liability for unauthorized withdrawals on an ATM or debit card at $50.
How to Protect Your Cards and Information
Know where your credit, debit, and ATM cards are, and make sure they're secure. Here are some more tips for using and protecting your cards.
Tips for Using and Protecting Your Credit Card
- Exercise caution in giving out your credit card account number over the phone. Don't give out the card number unless you initiate the call.
- Don't leave blanks on charge slips; draw a line across any blanks.
- Always take your receipts, and keep them until you reconcile your bill.
- Cut up or shred your old cards.
- Carry only the cards you think you'll need.
- Make and keep a record of your card information, listing the issuer's customer service number, and keep this in a safe place.
- Ignore anyone contacting you to "verify" your account information by phone or email. The call or message could be a phishing scam designed to steal your account information.
Tips for Using and Protecting Your Debit and ATM Cards
- Always take your receipts; don't throw them away in a trash can near the ATM.
- Protect your PIN. Never leave this information out in the open or written down in an easy-to-spot location. Don't keep a copy of your PIN with you or the card.
- Don't base PINs on common personal information, like your address, family birth dates, or pets' names—those are easy for a thief to figure out.
- Cut up or shred your old cards.
- Record your transactions, and reconcile your monthly statement promptly.
- You should also periodically check your account activity, especially if you use online banking. Compare the transactions to those you've recorded and report any discrepancies to your bank right away.
Learn More
The Federal Trade Commission website is a useful resource for information on consumer protection laws and issues related to credit, debit, and ATM cards and their use. If you have an issue with your credit card issuer or bank, you may submit a complaint to the Consumer Financial Protection Bureau (CFPB). The CFPB will forward your complaint to the company and work to get you a response.
For more information on finances, debts, and how to regain financial health, get Solve Your Money Troubles: Debt, Credit & Bankruptcy, by Amy Loftsgordon and Cara O'Neill (Nolo).