Debit Card

A debit card is a payment card that draws on the balance of the deposit account it is attached to, so a purchase reduces that account rather than creating a debt. Regulation E treats a transfer resulting from a debit card transaction as an electronic fund transfer under 12 CFR 1005.3(b)(1)(v), "whether or not initiated through an electronic terminal", which is why an online purchase and a checkout terminal are governed identically.

The card's legal name is broader than the object. 12 CFR 1005.2(a)(1) defines an access device as "a card, code, or other means of access to a consumer's account, or any combination thereof, that may be used by the consumer to initiate electronic fund transfers." So the rules attach to the means of access rather than to the plastic: the card number typed into a website, the credential stored in a phone wallet, and the PIN are all part of the same legal object. That is also why replacing a card does not by itself resolve a problem with a stored credential.

A second term in the same section does load-bearing work later. Under 1005.2(a)(2) a device becomes an accepted access device when the consumer requests and receives it, signs it, uses it, requests validation of a device issued unsolicited, or receives it in renewal of or substitution for an accepted device. A card sitting unactivated in an envelope is not yet accepted, and the distinction has consequences.

Two preconditions come before the liability tiers, and almost nobody writes about them. 12 CFR 1005.6(a) provides that a consumer may be held liable for an unauthorized electronic fund transfer "only if the financial institution has provided the disclosures required by § 1005.7(b)(1), (2), and (3)", which are the initial disclosures of the consumer's liability, the telephone number and address for reporting, and the institution's business days. It adds that where the transfer involved an access device, "it must be an accepted access device and the financial institution must have provided a means to identify the consumer to whom it was issued."

Read that as written and the order of operations is clear. The tiers below are ceilings on a liability that exists only if both conditions are met. A card that was never accepted, or an institution that never gave the required disclosures, does not produce a $50 question or a $500 question.

The three tiers, in the regulation's own terms. Under 12 CFR 1005.6(b)(1), where the consumer notifies the institution within two business days after learning of the loss or theft of the access device, liability may not exceed the lesser of $50 or the amount of unauthorized transfers occurring before notice. Under (b)(2), where the consumer does not notify within those two business days, liability may not exceed the lesser of $500 or the sum of two components: $50 or the amount of unauthorized transfers occurring within the two business days, whichever is less, plus the amount of transfers occurring after the close of those two business days and before notice, which the institution establishes would not have occurred had it been notified in time. Under (b)(3), a consumer must report an unauthorized transfer appearing on a periodic statement within 60 days of the institution's transmittal of that statement to avoid liability for subsequent transfers, and failing that, liability is limited to the transfers occurring after the 60 days close.

The 60-day rule is the one most often described backwards, and the error runs in the direction that makes people give up. It does not say that reporting late costs you everything. It limits liability to transfers occurring after the window closes. What (b)(3)'s final sentence does add, and what a reassuring summary tends to drop, is that where an access device is involved the consumer may still be liable for the (b)(1) or (b)(2) amounts as applicable. So a late-reporting debit card holder is not automatically at zero, and is also not automatically ruined.

The extension nobody invokes. 12 CFR 1005.6(b)(4) provides that if the consumer's delay in notifying was due to extenuating circumstances, "the institution shall extend the times specified above to a reasonable period." That is written as a duty on the institution rather than as a favor, and a hospital stay, a deployment, or an extended absence is the situation it exists for. It is worth naming explicitly when reporting late.

How notice counts, which decides more cases than the tiers do. Under 1005.6(b)(5) notice is given when the consumer takes steps reasonably necessary to provide the institution with the pertinent information, "whether or not a particular employee or agent of the institution actually receives" it, and it may be given in person, by telephone, or in writing. Written notice counts from the time it is mailed or delivered for transmission. Because the tiers all measure from the moment of notice, establishing when notice happened is worth as much as knowing what the caps are, and a phone call followed by a dated written confirmation does that.

Zero-liability policies are real and are not this. Card networks and many issuers advertise broader protection than the regulation requires. Those promises are voluntary policy, subject to the conditions the issuer sets, and can be changed. They sit on top of the regulation rather than replacing it, which is why the regulation is what to reason from when something goes wrong.

You present the card, or its number, and the merchant's processor asks your bank to authorize the amount. Your bank places a hold against the available balance and later settles the transaction, which is why a pending authorization can reduce what you can spend before the money has actually moved. The purchase posts to the deposit account, and there is no bill, no statement balance to pay off, and no interest.

A hypothetical example of what the two-business-day deadline is worth. The amounts are invented; the rules are 12 CFR 1005.6(b)(1) and (b)(2).

Yusuf's card is stolen on Monday and he notices the same day, so Monday is the day he learns of the loss. On Tuesday a thief spends $200. On Thursday the thief spends $900. Yusuf reports the card on Friday.

Had he reported by Wednesday, within two business days of learning, (b)(1) would cap his liability at the lesser of $50 or the $200 of transfers occurring before notice, so $50.

He did not, so (b)(2) applies. Its first component is $50 or the amount of unauthorized transfers occurring within the two business days, whichever is less: the transfers in that window total $200, so the component is $50. Its second component is the transfers occurring after the close of those two business days and before notice, which the institution establishes would not have happened had he called in time: the Thursday $900. The sum is $950 ($50 plus $900), and his liability is the lesser of $500 and $950, so $500.

Two days of delay cost $450 ($500 minus $50). Notice also what did the work: it was not the delay by itself but the fact that a large transfer landed during the delay. Had the thief spent nothing after Wednesday, the second component would have been zero, the sum would have been $50, and his liability would have been $50 either way. The deadline matters because of what can happen on the other side of it.

Pros

• You spend money you have, so there is no balance to repay and no interest.
• Liability for unauthorized use is capped by regulation, and the cap cannot be increased by an account agreement.
• The institution must have given specific disclosures and issued an accepted device before any liability attaches at all.
• Deadlines are extended to a reasonable period where the delay was due to extenuating circumstances.
• Accepted almost everywhere a credit card is, and usable at ATMs, without a credit application.

Cons

• The money leaves your account first, so you are seeking a refund rather than withholding a payment while a dispute runs.
• Liability rises with delay and can reach the transfers occurring after the 60-day statement window with no ceiling.
• Authorization holds reduce the available balance before settlement, which is a common route into an overdraft.
• Using it does not build a credit history, because nothing is borrowed and nothing is reported as credit.
• Zero-liability promises above the regulation are voluntary policy and can be changed or conditioned.