Research · 6 min read
Who Carries the Loss on an Unauthorized Account Debit
Two federal rules answer the question, and they answer it differently. A card has one ceiling. A deposit account has three, and which one applies depends on how quickly the transfer was reported.
Key takeaways
- Unauthorized use of a credit card carries a single ceiling: the lesser of fifty dollars or the amount obtained before notification.
- Unauthorized electronic fund transfers carry a ladder — fifty dollars with notice within two business days of learning of a lost or stolen access device, up to five hundred dollars without it, and separate exposure for transfers after an unreported statement item passes sixty days.
- No liability attaches at all unless the institution gave the required disclosures, the device was accepted, and the institution provided a means to identify the person authorized to use it.
- The statute puts the burden of proof on the financial institution to show a transfer was authorized or that the conditions of liability were met.
- Notice counts when reasonable steps were taken to provide the information, by any of several means, and the time limits extend for extenuating circumstances.
- A charge from a seller the consumer previously authorized is not unauthorized use as these rules define it.
Answer first: the card ceiling is flat, the deposit account ceiling is a ladder
Regulation Z sets a single figure for credit cards. The liability of a cardholder for unauthorized use of a credit card shall not exceed the lesser of fifty dollars or the amount of money, property, labor or services obtained by the unauthorized use before notification to the card issuer.
Regulation E sets a three-rung structure for electronic fund transfers from a deposit account. Where the consumer notifies the financial institution within two business days after learning of the loss or theft of the access device, liability shall not exceed the lesser of fifty dollars or the amount of unauthorized transfers occurring before notice.
Where the consumer does not notify within two business days, liability shall not exceed the lesser of five hundred dollars or the sum of two components: fifty dollars or the amount of unauthorized transfers within the two business days, whichever is less; plus the amount of unauthorized transfers occurring after the close of those two business days and before notice, provided the institution establishes that those transfers would not have occurred had the consumer notified within the two-day period.
The third rung is separate and runs off the statement rather than off the device. A consumer must report an unauthorized transfer appearing on a periodic statement within sixty days of the institution's transmittal of that statement to avoid liability for subsequent transfers. If the consumer does not, liability shall not exceed the amount of unauthorized transfers occurring after the close of the sixty days and before notice, which the institution establishes would not have occurred had the consumer notified within the sixty-day period. Where an access device is involved, the amounts from the first two rungs may also apply.
The practical shape of this is that a recurring debit to a bank account and a recurring charge to a card sit under different ceilings, and the deposit-account ceiling depends on reading statements.
What has to be true before any liability attaches at all
Both rules place conditions on the institution before the consumer can be held liable for anything.
Under Regulation E, a consumer may be held liable only if the financial institution has provided the initial disclosures covering consumer liability, the telephone number and address for reporting unauthorized transfers, and the institution's business days. Where an access device was involved, it must be an accepted access device and the institution must have provided a means to identify the consumer to whom it was issued.
Under Regulation Z, a cardholder is liable for unauthorized use only if the card is an accepted credit card; the issuer has provided adequate notice of the maximum potential liability and of the means of notifying the issuer of loss or theft; and the issuer has provided a means to identify the cardholder on the account or the authorized user of the card. The notice must state that liability shall not exceed fifty dollars, or any lesser amount, and that notification may be oral or written, and must describe a means of notification such as a telephone number, an address, or both.
The statute adds the allocation that governs a contested case. In any action involving a consumer's liability for an unauthorized electronic fund transfer, the burden of proof is upon the financial institution to show that the transfer was authorized, or, if unauthorized, to establish that the conditions of liability have been met and that the required disclosures were in fact made.
The statute also closes the outer boundary: except as provided in that section, a consumer incurs no liability from an unauthorized electronic fund transfer.
What counts as notice, and the extensions that exist
Both rules define notice generously and identically in substance.
Regulation E states that notice is given when a consumer takes steps reasonably necessary to provide the institution with the pertinent information, whether or not a particular employee or agent actually receives it. The consumer may notify in person, by telephone or in writing. Written notice is considered given at the time the consumer mails it or delivers it for transmission by any other usual means. Notice may also be considered constructively given when the institution becomes aware of circumstances leading to a reasonable belief that an unauthorized transfer has been or may be made.
Regulation Z says the same for cards. Notification is given when steps have been taken as may be reasonably required in the ordinary course of business to provide the issuer with pertinent information about the loss, theft or possible unauthorized use, regardless of whether any particular officer, employee or agent in fact receives the information. It may be given in person, by telephone or in writing, and written notification is considered given at the time of receipt or, whether or not received, at the expiration of the time ordinarily required for transmission, whichever is earlier.
Regulation E provides an extension. If the consumer's delay in notifying was due to extenuating circumstances, the institution shall extend the specified times to a reasonable period. The statute names extended travel or hospitalization as examples of extenuating circumstances for both the sixty-day statement window and the two-business-day device window.
Where a lower number governs, and the business-card carve-out
Both rules defer downward. Regulation E states that if state law or an agreement between the consumer and the financial institution imposes less liability than the section provides, the consumer's liability shall not exceed the amount imposed under that state law or agreement. Regulation Z states the same for cards: if state law or the cardholder agreement imposes lesser liability, the lesser liability governs.
The statute reinforces it. Nothing in the section imposes liability upon a consumer for an unauthorized electronic fund transfer in excess of the consumer's liability under other applicable law or any agreement with the institution.
There is one carve-out worth knowing about because health purchases are sometimes routed through a business account. Regulation Z provides that if ten or more credit cards are issued by one card issuer for use by the employees of an organization, the section does not prohibit the issuer and the organization from agreeing to liability for unauthorized use without regard to the section. Liability may still be imposed on an individual employee only in accordance with the section.
One more interaction is set out in the statute. Where a transaction involves both an unauthorized electronic fund transfer and an extension of credit under an agreement to cover an overdrawn account, the limitation on the consumer's liability for that transaction is determined solely in accordance with the electronic fund transfer rules. A single transaction that touches both a deposit account and an overdraft line does not get two different ceilings.
Sources
- 12 CFR 1005.6, “Liability of consumer for unauthorized transfers” (Regulation E)The disclosure and accepted-access-device conditions for any liability; the two-business-day fifty-dollar ceiling; the five-hundred-dollar ceiling and its two-part sum when timely notice is not given; the sixty-day periodic statement rule; the extension of time limits for extenuating circumstances; the definition of when notice is given including constructive notice; and the deference to lower liability under state law or an agreement.
- 12 CFR 1026.12, “Special credit card provisions” (Regulation Z)The definition of unauthorized use; the fifty-dollar ceiling; the three conditions of cardholder liability including the content of the required notice; the definition of notification to a card issuer; the deference to lesser liability under state law or agreement; and the carve-out where ten or more cards are issued for employees of an organization.
- 15 U.S.C. 1693g, “Consumer liability”The accepted-access-device and identification conditions; the fifty-dollar ceiling; the sixty-day statement reporting rule and the two-business-day rule with a five-hundred-dollar cap; extended travel or hospitalization as examples of extenuating circumstances; the burden of proof on the financial institution; the rule that a combined unauthorized transfer and overdraft credit extension is limited solely under this section; and the statement that except as provided in the section a consumer incurs no liability from an unauthorized electronic fund transfer.
Frequently asked questions
What is the maximum a cardholder can be liable for on an unauthorized credit card use?
Regulation Z states that liability for unauthorized use shall not exceed the lesser of fifty dollars or the amount obtained by the unauthorized use before notification to the card issuer, and that liability attaches only where the card is an accepted card, the issuer gave adequate notice of maximum liability and the means of notification, and the issuer provided a means to identify the cardholder or authorized user.
Is a debit from a bank account treated the same way?
No. Regulation E sets three ceilings. Notice within two business days after learning of loss or theft of an access device caps liability at the lesser of fifty dollars or the transfers before notice. Later notice raises the cap to the lesser of five hundred dollars or a specified sum. And a transfer appearing on a periodic statement that is not reported within sixty days of the statement's transmittal carries its own exposure for later transfers that the institution establishes would not have occurred.
Who has to prove what?
The statute places the burden of proof on the financial institution to show that the transfer was authorized, or, if it was unauthorized, to establish that the conditions of liability were met and that the required disclosures were in fact made.
Does a charge from a company the consumer once signed up with count as unauthorized?
Regulation Z defines unauthorized use as use by a person other than the cardholder who lacks actual, implied or apparent authority, and from which the cardholder receives no benefit. A charge from a seller the consumer previously authorized does not fit that definition, which is why continuing charges are handled through error resolution, stop-payment and cancellation rules rather than through the unauthorized-use ceilings.
What counts as telling the bank?
Notice is given when the consumer takes steps reasonably necessary to provide the institution with the pertinent information, whether or not any particular employee receives it. It may be given in person, by telephone or in writing, and written notice counts from the time it is mailed or delivered for transmission. The institution must extend the time limits to a reasonable period where the delay was due to extenuating circumstances.
Can an agreement set a lower ceiling than the regulation?
Yes, in that direction only. Both regulations state that where state law or an agreement between the consumer and the institution imposes less liability, the lesser amount governs. The statute adds that nothing in it imposes liability in excess of what other applicable law or an agreement would impose.