Debit Card vs Credit Card Fraud Protection in the US: Regulation E, the $50 Rule, Zelle Scams, and How to Get Your Money Back

Updated October 7, 2026. Educational content for US consumers, not legal advice. Federal rules set the minimum protections described here; your bank, card network, or state may offer more. Check your account agreement for details.

You open your banking app and see a charge you never made. Maybe it's $14.99 from a store you've never heard of, maybe it's $900 drained from checking. The first question is always the same: will I get my money back?

In the United States the answer depends heavily on how the money left your account. Credit cards, debit cards, bank transfers, and payment apps like Zelle fall under different federal rules, with different deadlines and different limits on what you can lose. This guide explains those rules in plain English and gives you a step-by-step plan for the moment you spot fraud.

The two federal laws that protect you

• Credit cards are covered by the Truth in Lending Act (TILA) and the Fair Credit Billing Act (FCBA). They cap your liability for unauthorized charges at $50, and you owe nothing if the card number was stolen but you still have the physical card.
• Debit cards, ATM withdrawals, ACH transfers, and most electronic transfers from a bank account are covered by the Electronic Fund Transfer Act, implemented through Regulation E. Your protection there depends on how fast you report the problem.

The practical difference is huge. With a credit card, the fraud is the bank's money while it's being sorted out; you dispute a charge you haven't paid yet. With a debit card, the money is already gone from your checking account, and you're waiting for the bank to put it back.

Debit card fraud: the Regulation E timeline

Under Regulation E, your maximum liability for unauthorized electronic transfers depends on when you tell your bank:

When you report	Your maximum loss
Within 2 business days after learning your card or PIN was lost or stolen	$50
After 2 business days, but within 60 days after your statement is sent	Up to $500
More than 60 days after the statement showing the first unauthorized transfer	Potentially unlimited for transfers made after that 60-day window

One important detail: if your physical card wasn't lost or stolen (for example, a skimmer copied your card number or a data breach exposed it) and you report unauthorized transfers within 60 days of the statement on which they first appear, you generally have no liability for those transfers. The 60-day clock is the one that matters most, which is why reading your statements, or at least your app alerts, every month is real financial protection.

Many banks go further than the law. Visa and Mastercard both promote "zero liability" policies for debit and credit cards, though those policies have conditions and may not cover every type of transaction, such as some PIN-based purchases.

How the bank investigation works

When you report an error or unauthorized transfer on a bank account, Regulation E gives the bank firm deadlines:

• 10 business days to investigate and decide whether an error happened.
• If it needs more time, the bank can take up to 45 days, but it generally must give you a provisional credit for the disputed amount within those first 10 business days, so you can use the money while it investigates.
• Longer windows (up to 90 days) can apply to new accounts, point-of-sale debit transactions, and foreign transactions.
• If you report by phone, the bank may ask you to confirm in writing within 10 business days. If you don't, it may not have to give provisional credit, so follow up in writing or through the bank's secure message center.
• When the investigation ends, the bank must tell you the result. If it denies your claim, you can ask for the documents it relied on.

Keep a simple log: the date you noticed the charge, the date and time you called, the name of the person you spoke with, your claim number, and copies of every message. That paper trail matters if you need to escalate.

Credit card fraud and billing disputes

Credit cards are the most forgiving way to pay. Under federal law, your liability for unauthorized use is capped at $50, and in practice most major issuers charge you nothing for genuine fraud.

The Fair Credit Billing Act also covers billing errors, not just fraud. That includes charges for the wrong amount, items you were billed for but never received, and goods that weren't delivered as agreed. To use those rights:

1. Send your dispute to the card issuer so it arrives within 60 days after the statement with the error was sent. Many issuers accept online disputes, but a written notice to the billing-error address preserves your full FCBA rights.
2. The issuer must acknowledge your dispute within 30 days and resolve it within two billing cycles (no more than 90 days).
3. While the dispute is open, you don't have to pay the disputed amount or related interest, though you still owe the rest of your bill.

This is a big reason many personal finance experts suggest using a credit card, paid in full every month, for online shopping, travel bookings, and gas pumps, where skimming and fraud are more common. If something goes wrong, the issuer's money is at risk first, not your rent money.

Zelle, Venmo, and bank transfer scams: the gray zone

Peer-to-peer payments are where many Americans get the worst surprise. Federal protections hinge on one word: unauthorized.

• If a criminal gets into your account (for example, by stealing your login or taking over your phone number) and sends money without your permission, that transfer is generally treated as unauthorized under Regulation E. Report it immediately and the bank-error rules above apply.
• If you were tricked into sending the money yourself, such as paying a fake landlord, a "seller" who never ships, or a romance scammer, banks often treat the payment as authorized, and federal law may not require them to refund it.

Some banks do voluntarily reimburse certain imposter scams, especially when the criminal pretended to be the bank itself or a government agency. Always ask, file a claim, and put your request in writing, but don't count on getting the money back.

Red flags of a payment app scam

• A text or call claiming to be your bank's fraud department that asks you to "send money to yourself" or to a "safe account." Banks don't ask you to move money to protect it.
• Pressure to pay quickly, with gift cards, crypto, wire transfers, or a payment app.
• A request to share a one-time passcode you just received. That code is the key to your account.
• Deals that are much cheaper than anywhere else, especially for rentals, concert tickets, puppies, or cars.

A simple rule: only use Zelle and similar apps with people you know and trust. For buying from strangers, a credit card or a payment option with purchase protection is far safer.

What to do the moment you spot fraud

1. Lock or freeze the card in your banking app. Most US banks let you do this instantly.
2. Call the number on the back of your card or in your official app. Never use a phone number from a text or email you received.
3. Report every unauthorized transaction, not just the big one. Small "test" charges often come first.
4. Follow up in writing and save your claim number.
5. Change your passwords and turn on app-based two-factor authentication for your bank and email.
6. Check your credit reports at AnnualCreditReport.com and consider a free credit freeze at Equifax, Experian, and TransUnion if your personal information was exposed.
7. Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov, or at IdentityTheft.gov if someone opened accounts in your name.

If the bank says no

If your bank or card issuer denies a claim you believe is valid, ask for the explanation and the documents it relied on, and request a review by a supervisor. You can also file a complaint with the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov/complaint. The company is expected to respond, and complaints often get a second look from a different team. For problems with a federally chartered bank, the Office of the Comptroller of the Currency also accepts complaints, and your state attorney general's consumer protection office can be another option.

Simple habits that limit your risk

• Turn on real-time transaction alerts for every card and account, even small charges.
• Use your credit card for online and travel purchases and keep your debit card for ATM withdrawals.
• Keep only what you need in checking and park savings in a separate high-yield savings account that has no debit card attached.
• Use your phone's digital wallet (Apple Pay, Google Pay, Samsung Pay) at stores; tokenized payments don't share your real card number with the merchant.
• Check pay-at-the-pump card readers for loose parts, and cover the keypad when entering a PIN.
• Review your statements every month so you never miss the 60-day window.

The bottom line

Credit cards give you the strongest, simplest fraud protection in the US: a $50 legal cap, the right to withhold payment during a dispute, and the issuer's money on the line instead of yours. Debit cards are protected by Regulation E too, but your liability grows the longer you wait, so speed is everything. Payment app scams where you authorized the transfer are the weakest spot, so treat Zelle like cash. Turn on alerts, report fast, put everything in writing, and escalate to the CFPB if your bank won't do the right thing.