Security Scams that go straight for your money
How long do you have to report fraud to your bank?
The deadline to report an unauthorized charge in the US, UK and EU, for debit cards, credit cards, checks and scam transfers, and what reporting late costs you.
The short answer
- In the US, report an unauthorized debit or bank transfer within 60 days of the statement that shows it, and a lost or stolen card within two business days to keep your loss to $50.
- The two day and 60 day figures are not competing answers: two days earns the lowest cap, and 60 days is when your share of further losses stops being capped.
- Credit cards cap unauthorized use at $50 with no reporting deadline on the cap, but the written billing error notice is due within 60 days of the statement.
- In the UK and the EU you have 13 months from the debit date, and you must still report without undue delay once you know.
- A UK bank transfer you made because you were tricked can be claimed for 13 months after the last payment, up to £85,000.
- This is general information rather than legal advice, and your account agreement or country may add rules of its own.
In the US, report an unauthorized debit card payment or bank transfer within 60 days of the bank sending the statement that first shows it, and within two business days of noticing that your card is lost or stolen if you want your loss capped at $50. In the UK and the EU the outer limit is 13 months from the date the money left your account, and a UK scam payment you made yourself can be claimed for 13 months after the last payment. These are maximums: every rule below rewards speed.
The deadlines side by side
These are the limits as the regulations set them. Read the fourth column: "60 days" means little until you know what starts the count.
| Rule | What it covers | Report within | Clock starts | Most you can lose if you report in time |
|---|---|---|---|---|
| US, Regulation E | Debit card, ATM card or PIN lost or stolen | 2 business days for the lowest cap | When you learn of the loss or theft | $50, rising to $500 after two business days |
| US, Regulation E | Unauthorized transfer on your bank statement | 60 days | When the bank sends the statement | As above; after 60 days, later transfers you could have stopped, with no cap |
| US, Regulation Z | Unauthorized credit card charge | 60 days for a written billing error notice | The first statement showing the charge | $50, and the cap has no reporting deadline of its own |
| US, UCC 4-406 | Forged or altered paper check | Reasonable promptness, one year at most | When the statement or checks are made available | Later forgeries by the same person, if you took more than 30 days |
| UK, Payment Services Regulations 2017 | Unauthorized or wrongly executed payment | Without undue delay, 13 months at most | The debit date | £35, or everything if you acted fraudulently or with gross negligence |
| UK, APP scam reimbursement | UK bank transfer you made because you were tricked | 13 months | The last payment in the scam | A £100 excess, with claims capped at £85,000 |
| EU, PSD2 | Unauthorized or wrongly executed payment | Without undue delay, 13 months at most | The debit date | €50, or everything if you acted fraudulently or with gross negligence |
American rules use short, layered clocks that raise your share as time passes. British and European rules use one long outer limit plus a duty to report "without undue delay", which a bank can cite if you sat on a charge you knew about.
Why two days and 60 days both get quoted
Both "two days" and "60 days" circulate as the answer for US debit cards. Both come from Regulation E, 12 CFR 1005.6, and they measure different things. The 60 day rule is the deadline. The two day rule is a discount for being fast.
There are three tiers. If your card or PIN is lost or stolen and you tell the bank within two business days of learning of it, your liability is the lesser of $50 or the amount taken before you called. After two business days it can rise to $500. The third tier is the one that hurts: you must report an unauthorized transfer that appears on a statement "within 60 days of the financial institution's transmittal of the statement to avoid liability for subsequent transfers". Miss that, and you can be liable for transfers made after the 60 days and before you finally speak up, if the bank shows that reporting on time would have stopped them.
Notice what starts the 60 days: the bank sending the statement, not the day the money went. A charge early in a monthly cycle can be nearly three months old before that clock runs out, which is why ignoring statements is the costly habit. If no card was involved, say someone got into your online banking, only the 60 day tier applies. Where your delay was caused by extenuating circumstances, the rule says the bank "shall extend the times specified above to a reasonable period".
Three points from the Consumer Financial Protection Bureau's guidance surprise people. Your negligence, such as writing your PIN down, "cannot be used as the basis for imposing greater liability" than these tiers allow. The bank may not delay its investigation until you file a police report or contact the merchant. And the law's anti-waiver clause means an account agreement cannot give you a shorter deadline than the regulation does.
Credit cards and checks run on different clocks
Credit cards are stronger. Regulation Z, 12 CFR 1026.12, limits your liability for unauthorized use to the lesser of $50 or the amount obtained before you notified the issuer, and unlike Regulation E that cap is not tied to a reporting deadline. The 60 days that does apply comes from the separate billing error rule in 1026.13: a written notice "no later than 60 days after the creditor transmitted the first periodic statement" that shows the charge. The issuer must then acknowledge it within 30 days and resolve it within two complete billing cycles, never later than 90 days. An unauthorized charge counts as a billing error, so use both protections. For purchases you did make, see disputing a payment and chargebacks.
Paper checks follow the Uniform Commercial Code as each state adopted it. Section 4-406 says you must examine your statement "with reasonable promptness". If the same wrongdoer forges more checks after you had a reasonable period, "not exceeding 30 days", to report the first, those losses can fall on you. After one year from the statement being made available, you cannot assert the forged signature or alteration against the bank at all. Section 4-103 lets an agreement vary these provisions within limits, so check your account terms.
The UK and EU: 13 months, and undue delay
British law is regulation 74 of the Payment Services Regulations 2017: you are entitled to redress only if you notify your bank "without undue delay, and in any event no later than 13 months after the debit date". Once notified of an unauthorized payment, the bank must refund it "no later than the end of the business day following the day on which it becomes aware", unless it reasonably suspects fraud by you and reports it to the authorities.
Your share is set by regulation 77. For a lost or stolen card or credential the bank can charge you up to £35, and nothing at all for misuse after you told it, or for a loss you could not have detected before the payment. You carry the whole loss only if you acted fraudulently or failed in your security obligations "with intent or gross negligence".
The EU's second Payment Services Directive is almost word for word the same. Article 71 sets the 13 months from the debit date, Article 73 requires a refund by the end of the following business day, and Article 74 caps your loss at €50 unless there was fraud or gross negligence. A new EU Payment Services Regulation agreed in 2025 adds protections against bank impersonation, but it was not yet in application in October 2026.
When you sent the money yourself
Everything above concerns payments you did not make. A transfer you approved because a scammer lied to you is handled differently.
In the US, the line is who pressed send. The CFPB says that when a caller pretending to be your bank tricks you into handing over your login, a texted code or your card number, and then uses it to move money, those transfers "meet the Regulation E definition of unauthorized EFTs", so the 60 day rule applies. If you made the transfer yourself, Regulation E generally does not cover it, which is why the first hour after sending money to a scammer is about recall requests rather than refund rights. The script that gets people to make that transfer themselves is described in how the safe account scam works.
The UK is the exception. Since 7 October 2024, payments from one UK bank account to another by Faster Payments or CHAPS have been covered by mandatory reimbursement. Report "as soon as possible, and within 13 months", and for a scam paid in instalments, like most romance scams, the window runs from the final payment. Claims are capped at £85,000, firms may apply an optional £100 excess, and you can expect reimbursement within five business days. Only complicity or gross negligence, which the regulator calls a high bar, defeats a claim, and neither that nor the excess applies to vulnerable consumers.
Where these rules stop
This is general information, not legal advice about your own claim. Regulation E covers consumer accounts, so business accounts depend on their contracts. The UK scheme covers domestic transfers, not card payments, international wires or crypto. Other countries set their own limits. Goods that turned out poor are a dispute, not fraud.
What to do today
- Call the number on your card or in your banking app, never one from a text or caller, because the number on your screen can be faked.
- Put it in writing the same day, noting the date, time and who you spoke to.
- Read every statement. The US clocks start when the statement is sent. Alerts help too, and the banking habits that make fraud hard covers which ones to switch on.
- Report it outside the bank. A reference number helps your claim, and reporting a scam to the right body lists who to tell in each country.
- Check for wider damage. If the thief had your personal details, not just a card number, watch for the early signs of identity theft.
Common questions
Can I still report fraud after 60 days?
Yes. In the US the 60 days under Regulation E is not a bar on reporting: it decides how much of the loss can fall on you. Transfers before the deadline keep their $50 or $500 cap, while transfers after it that a timely report would have stopped can be yours. Report anyway, and mention anything, such as a hospital stay, that delayed you, because the rule allows extensions for extenuating circumstances.
Does a bank have to refund fraud if I report it late?
Within the limits, mostly yes. In the UK and EU a report inside 13 months keeps your rights, though a bank can argue undue delay if you knew about a charge for months. In the US the bank still has to investigate, and late reporting changes your share of the loss rather than whether you can complain. Past the outer limits, a refund is usually goodwill.
How long does a bank have to investigate a fraud claim?
In the US, 10 business days, or up to 45 days if it gives you a provisional credit within the first 10. That stretches to 90 days for point of sale debit transactions, foreign transfers and new accounts. In the UK and EU an unauthorized payment must be refunded by the end of the next business day unless fraud by you is suspected.
Is there a time limit for credit card fraud?
Your $50 cap under Regulation Z has no reporting deadline written into it, but the formal billing error process needs a written notice within 60 days of the first statement showing the charge. That process is what forces the issuer to acknowledge and resolve the dispute on a timetable, so file inside the 60 days even if you have already phoned.
Do I have to file a police report before my bank will act?
Not in the US for electronic transfers. The CFPB says a bank must start investigating once you give notice and cannot delay until you supply a police report. A report still helps your claim, because the reference number links your case to others.