CardBenefitsFinder

US credit card benefits, checked against the issuers

Try a card (“Sapphire Preferred”), a bank (“Citi”) or a benefit (“cell phone protection”).

Menu navigation

Who pays when someone uses your credit card without permission

Under the Truth in Lending Act and Regulation Z, you owe at most $50 for unauthorized use of your credit card, and nothing for charges made after you notify the issuer. Seven issuers whose cards this site covers add a $0 liability promise on top, each with its own conditions.

Compiled from official sources Published Oct 11, 2026 Last reviewed How we research
Hands typing on a laptop beside a phone while holding a payment card
Contents8 sections

Key takeaways

  • Your liability for unauthorized credit card use cannot exceed the lesser of $50 or the amount charged before you notify the issuer.⁠2
  • Charges a thief makes after you report the card lost or stolen are not yours to pay.⁠1
  • A debit card has weaker protection, with a maximum of $500 if you report more than two business days after learning of the loss, and more if you miss the 60-day statement window.⁠3
  • Chase, Capital One, Discover, Citi, Bank of America, U.S. Bank and Wells Fargo promise $0 liability on the card pages recorded here, with conditions such as prompt reporting and verification.⁠6⁠7⁠8⁠9⁠10⁠11⁠12
  • To keep the billing-error rights, a written dispute must reach the issuer within 60 days after it sent the first statement showing the charge.⁠5

A stolen wallet, a skimmed card number or a data breach can put charges on your account that you never made. For a credit card, federal law sets a firm ceiling on what the issuer can make you pay for that use: $50, and often nothing at all.⁠1⁠2 Issuers then promise more than the law requires, while debit cards follow a separate and less forgiving set of rules.⁠3 This article covers the federal cap, what counts as unauthorized, how debit cards differ, what each issuer on this site adds, and what to do once you spot a charge you did not make.

The federal cap: $50, and often nothing

The Truth in Lending Act, at 15 U.S.C. 1643, makes a cardholder liable for unauthorized use only if every listed condition is met: the card is an accepted credit card, the liability is not in excess of $50, the issuer gave adequate notice of the potential liability, the issuer described how to report a lost or stolen card, the use happened before the issuer was notified, and the issuer provided a way to identify the authorized user.⁠1 Regulation Z repeats the rule at 12 CFR 1026.12(b): liability “shall not exceed the lesser of $50 or the amount of money, property, labor, or services obtained by the unauthorized use before notification to the card issuer”.⁠2

That wording has three practical effects. Charges made after you notify the issuer are never yours to pay, because the cap counts only use before notification.⁠1⁠2 If a thief spent less than $50 before you called, that smaller amount is the most you can owe.⁠2 And if state law or your card agreement sets a lower liability, the lower figure governs.⁠2

Advance notice is one of the conditions for any liability at all. Under Regulation Z you can be held liable only if the card is an accepted credit card, the issuer has given notice stating that liability will not exceed $50 (or a lesser amount), that you may notify the issuer orally or in writing, and how to do so, for example by telephone number or address, and the issuer has provided a means to identify the cardholder or authorized user.⁠2 Outside those conditions, the statute provides that a cardholder incurs no liability for unauthorized use.⁠1

The Federal Trade Commission sums up the credit card outcomes this way: report before anyone uses the card and you are not responsible for any charges you did not authorize; report after it is used and the most you might owe is $50; if only your account number is used and the card itself is not lost or stolen, you are not responsible for charges you did not authorize.⁠4

What counts as unauthorized use

Regulation Z defines unauthorized use as use of a credit card “by a person, other than the cardholder, who does not have actual, implied, or apparent authority for such use, and from which the cardholder receives no benefit.”⁠2 A thief using a stolen card, or a stranger using a skimmed number, fits that definition. A person you handed the card to may have authority in the regulation’s sense, so charges they run up can fall outside it.⁠2 Chase states one version of this limit in its own policy: Zero Liability Protection “does not apply to use of an account by an authorized user without the approval of the primary cardmember.”⁠6

The same kind of charge is also a billing error under 12 CFR 1026.13(a)(1), which covers a statement entry for credit “not made to the consumer or to a person who has actual, implied, or apparent authority” to use the card.⁠5 That gives you a second set of rights, with a written-notice deadline, covered in the steps below and in the article on disputing a credit card charge.

Notice to the issuer is given when you take the steps reasonably required in the ordinary course of business to pass on the information, whether or not a particular employee actually receives it.⁠2 You can give it in person, by telephone or in writing, at your option, and a written notice counts as given at receipt or when the normal transmission time has passed, whichever is earlier.⁠2

Debit cards follow different rules

A debit card is governed by the Electronic Fund Transfer Act’s Regulation E, and its liability limits depend on how fast you report.⁠3

Maximum consumer liability for unauthorized debit card transfers, 12 CFR 1005.6(b)
When you notify the bank Maximum liability
Within two business days after learning of the loss or theft The lesser of $50 or the transfers made before notice⁠3
More than two business days after learning of the loss or theft The lesser of $500 or the first two days’ transfers (up to $50) plus later transfers the bank shows notice would have prevented⁠3
Unauthorized transfer on a statement not reported within 60 days of the statement’s transmittal Transfers after the 60 days and before notice that the bank shows would not have occurred with timely notice, in addition to the amounts above when a card was involved⁠3

The bank must extend these deadlines to a reasonable period if your delay was due to extenuating circumstances.⁠3 The FTC’s summary puts the worst case plainly: report more than 60 calendar days after your statement is sent and you could lose all the money taken from your account, and possibly more, such as money in linked accounts.⁠4 The FTC also notes that debit transactions take money from your account right away.⁠4

What issuers promise on top of the law

Every issuer below states a $0 liability policy on the card page or terms recorded on this site. These are contractual promises with their own conditions; the $50 federal cap still applies underneath them.⁠2

Zero-liability policies recorded on this site, with the example card page each comes from
Issuer Policy wording Conditions the issuer states
Chase Zero Liability Protection “means you won’t be held responsible for unauthorized charges made with your card or account information”⁠6 Not for use by an authorized user without the primary cardmember’s approval; tell Chase immediately by calling Cardmember Services⁠6
Capital One “If your card is lost or stolen, you will not be responsible for unauthorized charges”⁠7 Claims are subject to investigation and verification⁠7
Discover “You’re never responsible for unauthorized purchases on your Discover Card”⁠8 An unauthorized purchase is one where you have not given access to your card information to another person or a merchant; claims are subject to investigation and verification⁠8
Citi “$0 Liability on Unauthorized Charges policy means you’re not responsible for those charges”⁠9 Not listed on the benefits page recorded here⁠9
Bank of America The $0 Liability Guarantee “covers unauthorized transactions made using your credit card account”⁠10 Notify the bank immediately; claims must be reported promptly and may be subject to dollar limits and verification⁠10
U.S. Bank “U.S. Bank provides zero fraud liability for unauthorized transactions”⁠11 Notify U.S. Bank promptly; certain conditions and limitations may apply⁠11
Wells Fargo Zero Liability Protection: you “won’t be held responsible for promptly reported unauthorized transactions”⁠12 Subject to conditions in the Consumer Credit Card Customer Agreement and Disclosure Statement⁠12

The example pages are the Chase Freedom Unlimited, Capital One Quicksilver, Discover it Cash Back, Citi Double Cash, Bank of America Customized Cash Rewards, U.S. Bank Cash+ and Wells Fargo Active Cash.⁠6⁠7⁠8⁠9⁠10⁠11⁠12 Discover’s footnote also asks cardholders to use reasonable care to protect the card and not to share it with employees, relatives or friends.⁠8

The American Express card pages recorded on this site do not include a zero-liability statement, so American Express is not in the table. The federal cap applies to its credit cards as to any other.

What to do, and how fast

  1. Report the card or charge immediately

    Notice ends your liability for anything charged afterward, and you can give it by phone.⁠2 The FTC advises calling, or using the issuer’s app, as soon as possible and keeping the issuer’s customer service number in your phone.⁠4 Bank of America asks you to notify it immediately, and Wells Fargo and U.S. Bank tie their promises to prompt reporting.⁠10⁠11⁠12

  2. Follow up in writing

    The FTC suggests a letter with your account number, the date and time you noticed the card missing and when you first reported it, and keeping a copy along with notes from your calls.⁠4

  3. Dispute statement charges within 60 days

    A billing error notice must be written and must reach the address the issuer lists for billing errors no later than 60 days after it sent the first statement showing the charge.⁠5 The issuer must acknowledge it within 30 days and resolve it within two complete billing cycles, and in no event later than 90 days.⁠5

  4. Keep checking your statements

    The FTC recommends comparing each statement with your receipts and reporting any charge you do not recognize as soon as you find it.⁠4

  5. Check for identity theft

    If unauthorized charges point to identity theft, the FTC directs you to IdentityTheft.gov to report it and get a recovery plan, and to your free credit reports to look for accounts you do not recognize.⁠4

  6. Move faster with a debit card

    Reporting within two business days of learning about the loss keeps a debit card’s liability at $50 or less.⁠3

Cards in this article

Sources

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12

Has something changed? Report an error

More from the blog

All articles