Under US Regulation E, a consumer's liability for unauthorized electronic fund transfers depends on how fast they report. Report within two business days of learning of the loss and liability is capped at 50 dollars. Later, the cap rises to 500 dollars. After 60 days from the statement, more exposure is possible.
The three tiers
Section 1005.6 of Regulation E sets the structure. This is a summary, so read the section before you rely on it.
- Prompt notice: within two business days of learning of the loss or theft, liability is capped at 50 dollars or the unauthorized transfers made before notice, whichever is less.
- Late notice: after two business days, with an access device involved, liability is capped at 500 dollars. That includes up to 50 dollars for the first two business days, plus later transfers if the institution shows timely notice would have prevented them.
- Statement items: a consumer who does not report an unauthorized transfer shown on a periodic statement within 60 days of the statement being sent can be liable for later transfers that timely notice would have prevented.
How the days are counted
The two business day period excludes the day the consumer learns of the loss and any non-business day. It is counted in 24-hour blocks regardless of the institution's business hours. The 60 days are calendar days counted from when the statement was sent. Extenuating circumstances such as extended travel or hospitalization can extend the deadlines to a reasonable period.
The regulation page also states that negligence, such as writing a PIN on the card, does not increase liability. Only timing matters.
Why this is an engineering topic
The tiers turn on timestamps. If your system cannot show when a customer reported, when a statement was sent and which transfers happened before notice, you cannot make the institution's case or the customer's. Dispute handling is a data problem.
What to log and keep
- The time the customer first reported a loss, in every channel: app, phone, chat and branch.
- The time each periodic statement was sent, not only generated.
- Every transfer with channel, device, authentication result and exemption reason.
- A clear record of freeze, block and reissue actions and their times.
- A case timeline that support staff and auditors can read without reconstructing events from logs.
Design choices that help customers
Fast, obvious reporting paths shorten the exposure window. A one-tap "report fraud" action in the app, with an instant card or credential lock, does more for both sides than a long form. Push alerts for new payees and large transfers give customers a chance to notice early.
Quick check
Does writing a PIN on a card raise a consumer's liability?
The regulation page states that negligence of this kind does not increase liability. Only the timing of the report matters.
Are the 60 days business days?
No. They are calendar days, counted from when the periodic statement was sent.
Sources
Last reviewed: 19 October 2026.
