Debit card and ACH disputes under Regulation E

What Regulation E covers

Regulation E covers electronic fund transfers from your account: point-of-sale purchases with a debit card, ATM withdrawals, transfers between your own accounts, and preauthorized transfers that a company pulls from your account — the ACH payments behind most bill descriptors.

If one of those transfers is unauthorized — you did not make it and did not allow it — Regulation E gives you a dispute right and caps what you can be held responsible for, depending on how fast you report it.

Liability tiers for lost or stolen cards

If your card or PIN was lost or stolen and you report the loss within two business days of learning of it, your liability is capped at fifty dollars. Wait longer than two business days and the cap rises to five hundred dollars.

If an unauthorized transfer appears on a statement but your card was never lost or stolen, you have sixty days from when the statement was sent to report it. Report in time and you generally owe nothing. Miss it, and you can be liable for unauthorized transfers that happen after the sixty-day mark and before you report.

What the bank must do when you report

Once you notify your bank of an unauthorized transfer, it generally has ten business days to investigate (twenty if the account is less than thirty days old). If it determines an error occurred, it must correct it within one business day and report its findings to you within three business days.

If the bank cannot finish its investigation in ten business days, it must usually issue a provisional credit for the disputed amount while it keeps working, then resolve the matter within forty-five days — or ninety for foreign transactions, new accounts, or point-of-sale debit purchases.

Revolving authorization for ACH payments

Regulation E also gives you a way to stop companies from pulling automatic payments. You can revoke the authorization with the company, tell your bank, and — if needed — request a stop-payment order. After you revoke, any further payment the company initiates is an error you can recover.

This is separate from cancelling a subscription contract. Stopping the payment is not the same as ending the service agreement, so cancel the contract with the merchant and revoke the payment authorization separately.

1. Report a lost card within two business days That keeps liability capped at $50. Every day past two raises the cap to $500.
2. Scan statements and report within 60 days Statement-based unauthorized transfers must be reported within 60 days of the statement to avoid liability for later transfers.
3. Revoke ACH authorization in writing Tell the company and your bank you are withdrawing permission, and keep the confirmation.
4. Request provisional credit if the wait is long If the bank has not finished its investigation in ten business days, it must generally credit the disputed amount temporarily.

How debit and credit rules compare

Credit cards run under the Fair Credit Billing Act, which is generally friendlier: a sixty-day window from the statement for billing errors and a fifty-dollar cap on unauthorized charges without the same escalating deadlines. Debit cards run under Regulation E, where timing matters more.

That difference is why banks often recommend debit for budget discipline but credit for purchases where a dispute is more likely. The right choice depends on the situation; the important part is knowing which set of rules protects the card in your wallet.