Debit card fraud.

Debit card fraud is any use of a debit card, card number or PIN to take funds the customer didn't authorize. Because a debit card draws on the customer's own deposit account, each fraudulent charge leaves a hole until the claim is resolved. For consumer accounts, Regulation E sets how fast the bank must investigate and how much of the loss the customer can bear.⁠[2]

Is debit card fraud a federal crime?

Usually, yes. Under the access device fraud statute, which covers cards, card numbers and PINs, using or trafficking in counterfeit cards can bring up to 10 years in prison, and possessing device-making equipment up to 15.⁠[3] The Electronic Fund Transfer Act adds up to 10 years for using a counterfeit, lost, stolen or fraudulently obtained debit card to obtain $1,000 or more in a year.⁠[4] Defrauding a bank also falls under the bank fraud statute,⁠[5] and states prosecute card fraud too.

Who is liable for debit card fraud?

Toward the customer, Regulation E caps what a consumer pays for unauthorized transfers, depending on how fast they report; the issuer carries the rest unless it recovers it elsewhere.⁠[2] Between institutions, card network rules decide when the issuer can charge a transaction back to the merchant's bank. At large issuers in 2023, merchants absorbed 49.9% of debit fraud losses, issuers 28.3% and cardholders 21.8%.⁠[6]

In 2024, card fraud was the second most-reported fraud type in suspicious activity reports from banks and credit unions, after checks.⁠[8]

• 56% of banks and credit unions had debit card fraud losses in the prior 12 months, the highest share for any payment type, in a 2026 Federal Reserve Financial Services survey of 403 institutions.⁠[1]
• 17.6 basis points, or $17.63 per $10,000 of transactions: debit card fraud losses to all parties at issuers with $10 billion or more in assets in 2023, up from 7.8 basis points in 2011.⁠[6]
• 54.3% of those losses were card-not-present fraud, more than every other type combined.⁠[6]

A SAR counts a report, not a loss, and FinCEN's category combines credit and debit cards. The Federal Reserve's loss rates come from large issuers and may not represent smaller ones.

Most debit card fraud follows the same four steps.

1. 1Get the card data. Buy card numbers from a breach, skim them at an ATM or fuel pump, generate them with a bot, or trick the customer into reading out a card number or one-time code.
2. 2Test it. Run small authorizations, often at online merchants, to learn which numbers, expiration dates and security codes work.
3. 3Cash it out. Buy resellable goods online, encode the data onto a counterfeit card for ATM withdrawals, or add the card to a mobile wallet and spend in stores.
4. 4Spend before anyone notices. The fraud usually surfaces only when the customer sees an alert or a statement and calls, and that call starts the bank's Regulation E clock.

As EMV chips made in-person card payments more secure, card fraud shifted toward card-not-present, or remote, fraud, the Federal Reserve notes.⁠[6]

Which schemes are growing? In the Federal Reserve Financial Services' 2026 survey, card-not-present fraud led the reported increases (26% of institutions), followed by did-not-authorize-or-recognize claims (24%) and low-dollar write-offs (18%).⁠[1]

Red flags

• A burst of small authorizations or declines across cards in the same BIN range
• Repeated security-code or expiration-date mismatches on one card
• A card added to a new mobile wallet or device soon after a phone, email or password change
• Card-not-present spending far from the customer's usual merchants and amounts
• Magnetic-stripe or fallback transactions on a chip card
• Transactions in two places too far apart to travel between in the time
• Several fraud claims that trace back to one merchant or terminal
• A customer who disputes purchases at merchants they use every month

Generally 10 business days from the customer's notice, or up to 45 days (90 for some transactions) if the bank provisionally credits the account within those 10 business days.⁠[2]

The customer's report of a lost or stolen card2 business days from learning of the loss

Reporting in time keeps the customer's liability at $50 at most; later, it can reach $500 (see the table). The two days exclude the day the customer learns of the loss and run as 24-hour periods, whatever the bank's hours. Extenuating circumstances, such as a hospital stay, extend the time.

12 CFR 1005.6(b)(1), (2), (4) · Comment 6(b)(1)-3⁠[2]⁠[7]

The customer's 60-day statement window60 days from the statement

A notice of error is timely if the bank receives it within 60 days after sending the statement that first shows the error. For a later report of an unauthorized transfer, the bank must still apply the liability rules (see the table) before charging the customer anything.

12 CFR 1005.11(b)(1), 1005.6(b)(3) · Comment 11(b)(1)-7⁠[2]⁠[11]

Investigate and decide10 business days from the notice

The bank must investigate promptly and decide whether an error occurred within 10 business days, or 20 if the transfer came within 30 days of the account's first deposit. It reports the results within three business days of finishing and corrects an error within one business day of finding it. It may require written confirmation of an oral notice, but can't wait for it to start.

12 CFR 1005.11(b)(2), (c)(1), (c)(3)(i) · Comment 11(c)-2⁠[2]⁠[11]

The extended investigation, with provisional credit45 calendar days from the notice

The bank may take up to 45 days, or 90 for point-of-sale debit card transactions (including mail and telephone orders, but not ATM withdrawals), transfers not initiated within a state, and new accounts, if it provisionally credits the amount within 10 business days (20 for new accounts). It must tell the customer within two business days and give full use of the funds.

12 CFR 1005.11(c)(2), (c)(3)(ii) · Comment 11(c)(3)-1⁠[2]⁠[11]

Chargebacks vs. disputes

A dispute is the customer's claim to your bank; a chargeback is your bank's claim against the merchant's bank under card network rules. Network rules that protect consumers less don't change Regulation E: some count 60 days from the transaction date rather than the statement, and some let a bank send the customer to the merchant first, which Regulation E doesn't allow.⁠[10] Win or lose the chargeback, the claim is decided under Regulation E.

• Score every authorization in real time. Velocity, location, merchant category and the network's risk score can stop card testing and cash-out before the money moves.
• Give customers alerts and card controls. A message each time the card is used, and a lock in the app, make the customer an early detector, and a prompt report caps their liability.⁠[1]⁠[2]
• Make card testing expensive. Velocity limits by BIN range and merchant, strict security-code and expiration checks, and 3-D Secure on card-not-present payments slow enumeration attacks.⁠[1]
• Reissue exposed cards early. When claims trace to one merchant, terminal or attacked BIN range, reissue the other cards used there before they're hit. Risk officers list proactive card replacement among their fixes.⁠[1]
• Guard wallet provisioning. Step up verification when a card is added to a new device, especially right after a phone, email or password change.
• Investigate every claim on the clock. Start when the customer calls, not when paperwork arrives, review the relevant records you hold, and keep the evidence and the reason for each decision.⁠[11]⁠[10]
• File SARs on time. A SAR is due 30 calendar days after first detecting facts that may support one, or up to 60 if no suspect is identified. See SAR filing.⁠[12]

Why debit card disputes take so long

Deciding is quick once the picture is complete. Getting the picture is the slow part: the evidence for one disputed transaction sits in seven systems, and the 10-business-day clock runs while your analysts collect it.

So small claims often get credited without a look. Regulation E allows a final correction without investigating,⁠[11] and more than 80% of institutions in the Federal Reserve Financial Services survey had seen low-dollar write-offs, disputes smaller than the cost of researching them.⁠[1] But an unexamined claim is a pattern nobody sees: a BIN attack, a compromised terminal, a customer who disputes every month.

Socratix AI coworkers can take on the gathering. For every claim, they can pull the evidence from each system, compare the transaction with how the customer uses the card, and hand your analysts a recommendation with the reasoning laid out. Your team still makes every call. It just stops spending the clock assembling the picture.

Card-fraud SARs nearly quadrupled between 2014 and 2024,⁠[8] and every claim brings its own 10-business-day clock. Your team can't add analysts that fast. AI coworkers can do the gathering on every claim, so your people can spend their time on decisions and small claims can get a look instead of a write-off. FinCEN and the federal bank and credit union regulators have said pilot programs testing innovations such as artificial intelligence “should not subject banks to supervisory criticism even if the pilot programs ultimately prove unsuccessful.”⁠[13]

1. GatherCan pull the authorization (merchant, entry mode, authentication), the card's status history, device and wallet events, login and contact changes, and past claims from the systems that hold them, into one case.
2. AssessCan weigh authorized against unauthorized, check for first-party signals, compare the transaction with the customer's own card use, link claims that share a merchant, terminal or BIN range, and watch the Regulation E clocks.
3. RecommendCan recommend provisional credit, a final credit, a chargeback or a denial, with the evidence, a plain-language reason, and a draft SAR narrative when one is warranted. Your analyst decides.
4. LearnCan learn from each decision (your policies, your risk appetite, your analysts' judgment) and log every step for the examiner.

Related guides

• ACH fraud Unauthorized debits, account takeover and BEC-driven credits, and the Nacha return windows.
• Check fraud Washed, counterfeit and forged checks, mail theft, and the deadlines that decide who takes the loss.
• SAR investigations From alert to case to decision: how a suspicious activity investigation runs.
• SAR filing Deadlines, the narrative, continuing activity and confidentiality for suspicious activity reports.