Debit Card Fraud 60-Day Rule: Steps After Unauthorized Charges
An unfamiliar debit charge can quickly become a household emergency, especially when rent, groceries, or other bills depend on the same account. If a transaction is not yours, contact the bank or card issuer today through a verified channel, such as the number printed on the card or the institution’s official app. Avoid relying on an unverified customer-service number from a search result.
The phrase debit card fraud 60-day rule is often used to describe a reporting deadline, but the supplied federal guidance does not establish one universal 60-day answer for every debit-related transaction. The applicable process can depend on how the money moved, when the problem was discovered, whether the payment was authorized, and the account agreement. This is general reporting information, not individualized legal or reimbursement advice. Because the topic can affect financial rights, liability, and reimbursement, qualified legal and editorial review is appropriate before publication.
What to do first after an unauthorized debit charge
You do not need to solve the whole dispute before calling. Report what you know, ask which procedure applies, and create a record while the details are fresh.
1. Verify the transaction, then contact the issuer
Check the amount, date, merchant description, and whether the transaction is pending or posted. A name you do not recognize may not match the business name you remember, but an unfamiliar charge still deserves prompt attention when the card or account may be compromised.
Use the number printed on the card, the official banking app, or the institution’s official website. The CFPB reported in January 2025 that consumers searching online for Cash App support were targeted by impostors posing as representatives and were tricked into sharing passwords and other personal information (CFPB).
Tell the issuer whether the issue involves:
- a card purchase
- a transfer from a checking account
- an ACH payment
- a payment-app transaction
- a payment personally approved after a scammer contacted you
Ask how to submit the dispute formally. The institution may direct you to an in-app form, written notice, or another process. Follow that instruction rather than assuming that a phone call or chat message completes every required step.
2. Limit further access
If the issuer offers a card-lock or freeze feature, ask whether using it is appropriate. Also ask about replacing the card number if the physical card or card details may have been exposed.
A card freeze addresses the card, not necessarily every possible route into an account. If a password, PIN, one-time code, phone, or banking-app login may have been exposed, tell the institution and ask what account-security steps it recommends. Do not continue using a compromised password while waiting for the dispute decision.
3. Keep a clean record
Write down:
- the date and time of the report
- the representative’s name or identification number
- the case or confirmation number
- the transaction amount and description
- any instructions about forms or deadlines
Save screenshots of the transaction, account statements, messages connected to the incident, and written notices from the bank or payment app. A single folder, either paper or digital, is easier to manage than scattered notes when a claim is delayed or questioned.
The CFPB has explained that the Electronic Fund Transfer Act requires a financial institution to conduct a prompt, reasonable, and timely investigation after a consumer reports an account error. That source specifically addresses prepaid cards, including cards loaded with government benefits, so it should not be read as a complete explanation of every checking-account debit-card process (CFPB, in January 2023).
What the debit card fraud 60-day rule does and does not mean
There is no safe shortcut from the phrase “60-day rule” to a guaranteed outcome. The information supplied for this article does not provide the specific Regulation E reporting windows or liability amounts for every type of debit transaction. A reader should ask the issuer which reporting period applies to the particular payment and what statement, notice, or account record starts that period.
The word “unauthorized” also does not describe every scam loss in the same way. These examples show why the facts matter:
Situation What to tell the issuer A lost or stolen card was used When the card disappeared, when the charge appeared, and whether anyone had permission to use it Banking access may have been taken over Which password, PIN, phone, or one-time code may have been exposed, and whether transfers followed A scammer persuaded the account holder to approve a payment Who contacted the account holder, what the person claimed, and whether a code, approval, or transfer was completed
A card purchase made without permission, an account transfer after stolen credentials, and a payment the account holder initiated after being deceived may involve different payment systems and different review questions. The safest description is the most complete one. Do not label every incident simply as “fraud” if the issuer needs to know whether someone used the card, accessed the account, or persuaded the account holder to send money.
The CFPB said in November 2024 that consumers generally have rights to dispute incorrect or fraudulent transactions and that financial institutions must take steps to investigate them. That announcement focused on large nonbank digital payment apps, some of which the agency said appeared to shift disputes to banks, credit unions, or card companies rather than handling them directly (CFPB). For an app transaction, ask both the app and the linked bank which entity is opening the dispute and what deadline applies.
Why reporting speed still matters
Even without relying on a generic 60-day summary, waiting creates practical problems. More transactions may appear, records can become harder to organize, and the institution may need to determine whether the issue involves a card number, a login, a payment app, or an account transfer.
Javelin reported earlier this year that account takeover affected 6 million consumers in 2025, an 18% increase from 2024. Losses in that category fell 4% but still exceeded $15 billion, making account takeover the costliest fraud type in the study. The same study found that 30% of scam victims reported providing banking details, such as account numbers or PINs, to scammers (Javelin).
Those figures do not determine whether an individual claim will be reimbursed. They do show why a suspicious debit charge may be a sign of a wider account problem rather than a one-time card-number issue.
Pending charges, delayed reviews, and denied claims
A pending transaction can change before it posts. That possibility is not a reason to ignore a compromised card or account. Tell the issuer that the charge is pending and ask whether the institution wants the report opened immediately or after the transaction posts.
If the claim is denied, ask for the decision and reason in writing. Ask what information the institution reviewed and which category it used for the transaction. The answer may clarify whether the issuer treated the matter as a card purchase, electronic transfer, payment-app transaction, or payment authorized by the account holder.
A denial does not necessarily end every available review or complaint option, but it also is not proof that the decision was wrong. Check the account agreement, follow the institution’s reconsideration process if one exists, and keep copies of all responses.
The CFPB ordered Block, the operator of Cash App, to provide up to $120 million in refunds and other redress and pay a $55 million penalty after the agency’s action concerning the company’s handling of unauthorized-transaction disputes. The order concerned Cash App and does not determine how another bank or payment service must resolve an individual claim (CFPB, in January 2025).
If the response remains incomplete or the complaint is not resolved, consumers can submit a complaint through the CFPB’s website or call 855-411-2372. That is an escalation option, not a replacement for the issuer’s dispute process. A high-dollar or complicated dispute may also call for advice from a qualified consumer-protection attorney.
Five actions to take today
If an unauthorized debit charge appears, use this shorter checklist:
- Contact the issuer through a verified channel. Avoid an unverified number from a search result.
- Ask which deadline and dispute process apply. Do not assume the phrase “60-day rule” answers that question.
- Secure the wider account. Report exposed passwords, PINs, phones, one-time codes, or payment-app access, not just the card number.
- Describe how the money moved. State whether the card was used, the account was accessed, or a scammer persuaded you to approve a payment.
- Save the record. Keep the case number, screenshots, statements, messages, and written decision together.
The practical rule is straightforward: report suspicious activity promptly, explain exactly what happened, and ask the institution to identify the deadline and procedure for that specific transaction. Save the bank’s official fraud-reporting number in the phone, turn on transaction alerts, and review the account’s electronic-transfer disclosure before a household emergency makes those details harder to find.
