Zero Liability Protection

Zero liability protection is a promise made by a payment card network, and enforced by the network on the banks that issue its cards, that a cardholder will not be charged for transactions they did not authorize. It is a private policy, not a statute or a regulation, which is why its terms are set by the network rather than by Congress and why they can be changed without anyone voting on it.

The phrasing varies by network, and it is worth saying plainly that there is no official name here. Visa calls its version the Visa Zero Liability Policy and describes it as "our guarantee that you won't be held responsible for unauthorized charges made with your account or account information," and elsewhere describes it as Visa's own requirement that the cardholder's bank or issuer ensure the cardholder is not held responsible for unauthorized charges made with a Visa card. That second phrasing is the more accurate description of the mechanism: the network is imposing a rule on its issuers, and the cardholder's actual counterparty remains the bank. Everything quoted on this page is Visa's own text, because it is the network policy that could be read at source.

Why a private policy exists at all when there is already a federal rule. Federal law caps what a consumer can be charged for an unauthorized card transaction, but the caps are not zero and, on the debit side, they rise with delay in reporting. A network that wants its cards used online, abroad and by people who are nervous about both has a commercial reason to promise more than the law requires. The promise is genuine and worth having. It is also voluntary, which is the whole of the difference between a policy and a right.

What the policy actually says it does not cover. Visa states that the policy "does not apply to certain commercial card and anonymous prepaid card transactions or transactions not processed by Visa." The last limb is the one a cardholder is least likely to anticipate, because it turns on plumbing rather than on anything visible at the till: a transaction that reaches the account by some route other than the Visa network is outside the Visa policy even though the same piece of plastic was involved. Visa's own instruction is to "check with your financial institution on the coverage of your specific card," which is a fair summary of the position: the policy sets a floor for issuers and the issuer's own terms are what the cardholder holds.

The conditions attached to the money. Two of them are stated on Visa's page and both matter. The first is a duty on the cardholder: "Cardholders must use care in protecting their card and notify their issuing financial institution immediately of any unauthorized use." The second is that the money is not final when it arrives. Visa requires issuers "to replace funds taken from your account as the result of an unauthorized credit or debit transaction within five business days of notification," and adds that "the transaction-at-issue must be posted to your account before replacement funds may be issued." So a charge that is still pending has not yet started that clock. And the replacement itself is "provided on a provisional basis and may be withheld, delayed, limited, or rescinded by your issuer based on gross negligence or fraud, a delay in reporting unauthorized use, an investigation and verification of a claim, and account standing and history."

The most useful thing to understand, which almost nothing written for consumers says. Those carve-outs describe when the extra promise can be taken away. They do not, and cannot, describe a position worse than the federal one, because the federal rules are a ceiling on the consumer's liability rather than a default the parties can negotiate downward. Regulation E's Official Interpretations put it in one sentence at comment 6(b)-3: "no agreement between the consumer and an institution may impose greater liability on the consumer for an unauthorized transfer than the limits provided in Regulation E."

The negligence point is sharper still. A network policy may condition its promise on the cardholder not having been grossly negligent. Regulation E may not, and its commentary says so directly at comment 6(b)-2: "Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E. Thus, consumer behavior that may constitute negligence under state law, such as writing the PIN on a debit card or on a piece of paper kept with the card, does not affect the consumer's liability for unauthorized transfers." The practical reading is that carelessness can cost a cardholder the voluntary extra and cannot push them below the statutory floor. A cardholder told they were careless has lost an argument about the policy, not about the law.

Where the floor itself sits is a different question on each kind of card, and it is not the same number. The debit side is governed by Regulation E, where the amount turns on how quickly the loss is reported. The credit side is governed by the Truth in Lending Act and Regulation Z, where the cap is a flat figure with no reporting deadline attached to it. Our pages on the debit card and the credit card set out each in full, and the gap between them is the reason the same zero liability sticker is doing much more work on a debit card than on a credit card.

From the cardholder's side the sequence is short:

1. An unauthorized transaction posts to the account. Under Visa's terms the transaction has to post before replacement funds can be issued, so a pending authorization is not yet eligible.

2. The cardholder notifies the issuing bank, which the policy requires be done immediately, and which is also what the federal rules measure from.

3. The issuer replaces the funds within five business days of notification, on a provisional basis.

4. The issuer investigates, and may withhold, delay, limit or rescind the replacement on the stated grounds.

5. If the promise is withdrawn, the federal limits still stand, and no account agreement may set them higher.

A hypothetical example with invented figures; the terms are Visa's own. Ruth checks her account on a Tuesday and finds $840 of charges she did not make on her Visa debit card. Of that, $720 has posted and $120 is still shown as pending. She telephones her bank the same day.

The five-business-day replacement clock attaches to the posted amount, so it is the $720 that the policy requires be replaced within five business days of her notification. The remaining $120 is not yet eligible, because the transaction has to post first; once it does, it comes inside the same requirement. The arithmetic is simply $840 minus $120.

Suppose the bank later decides that Ruth delayed in reporting an earlier charge and rescinds part of the replacement. What she loses is the network promise. What she keeps is the statutory position, which is set by regulation and which her account agreement cannot make worse, and which for a debit card turns on the timing of her report rather than on the bank's view of her conduct.

Pros

• It is broader than the law on the debit side, where the statutory floor is not zero and rises with delay.
• No enrollment, registration or product upgrade is required for it to apply.
• It obliges the issuer to a defined replacement window, which is a real improvement on an open-ended investigation.
• Because it binds issuers through network rules, a cardholder does not have to have negotiated anything to benefit from it.

Cons

• It is a policy and not a right, so it can be conditioned, narrowed or withdrawn, and the stated grounds for rescinding it include a judgment about the cardholder's own conduct.
• The exclusions are not intuitive. A transaction that reaches the account over a different network is outside the policy despite involving the same card.
• Certain commercial card and anonymous prepaid card transactions are carved out by name.
• Replacement is provisional, so money arriving in the account is not proof the claim has been accepted.
• The phrase "zero liability" reads as an absolute and is not one, which is exactly the confusion that makes the underlying federal rules worth knowing.