Unauthorized Transaction: Your Liability Limits and How to Get Your Money Back

In the US, two different federal regimes govern unauthorized transactions, and they set genuinely different maximum liability: credit cards are covered by the Truth in Lending Act and Regulation Z, which cap your liability at $50 — reduced to $0 if the transaction was "card not present" or if you report before any unauthorized use occurs. Debit cards, ATM transactions, and other electronic fund transfers are covered instead by the Electronic Fund Transfer Act and Regulation E, which use a tiered liability schedule based on how quickly you report the loss or theft.

Many banks and card networks also voluntarily offer "zero liability" policies that go further than the federal minimums — but these are voluntary issuer policies, not federal law, and can carry exclusions (for example, some exclude certain PIN-based or business-account transactions). verify your specific card’s zero-liability terms and any exclusions before relying on it instead of the federal floor

The EU’s Payment Services Directive 2 (PSD2), and the UK’s equivalent Payment Services Regulations 2017 (retained after Brexit), work differently from the US tiered system. Before you notify your bank or card provider of a lost, stolen, or compromised payment instrument, your liability for unauthorized transactions is capped — €50 in the EU under PSD2, and £35 in the UK under Regulation 77 of the Payment Services Regulations 2017 — unless you acted fraudulently or with gross negligence (for example, writing your PIN on the card), in which case liability can be uncapped. You are also not liable at all if the loss, theft, or misappropriation wasn’t detectable by you before the payment (absent fraud on your part).

Once you notify your provider, your liability for any further unauthorized transactions drops to zero. Providers must also refund an unauthorized transaction promptly — generally by the end of the next business day — unless they have reasonable grounds to suspect fraud by you, pending investigation. This "refund first, investigate after" structure is generally more consumer-favorable on speed than the US dispute-and-investigate model.

A PSD3/Payment Services Regulation reform package reached provisional political agreement between the European Parliament and Council in late November 2025, and legislative text work continued into 2026, but as of July 2026 it had not yet entered into force — the new rules are expected to generally apply roughly 21 months after formal publication in the EU Official Journal, which itself has not yet happened. PSD2’s rules are what currently apply. verify current PSD3/PSR status before assuming any changed liability rules are already in effect

These liability caps apply to transactions you didn’t authorize — they generally do not cover a payment you did authorize but now regret (for example, willingly wiring money to a scammer), which is a fundamentally different, much harder problem: authorized transactions are not "unauthorized transactions" under Regulation E, Regulation Z, PSD2, or the UK rules, even though they may feel identical to the victim.

Peer-to-peer payment apps (Zelle, Venmo, and similar) sit in a genuinely contested area: if you were tricked into authorizing the transfer yourself, banks have often argued Regulation E’s unauthorized-transaction protections don’t apply, though this has drawn regulatory scrutiny from the Consumer Financial Protection Bureau. verify current CFPB guidance and any recent enforcement action on P2P fraud liability, since this area has been actively changing

Business accounts often have reduced or different consumer-protection coverage than personal accounts under both the US and EU/UK frameworks — check your account type before assuming the consumer liability caps above apply.

Straightforward unauthorized-transaction disputes — reported promptly, clearly not authorized by the accountholder, no gross negligence — are typically resolved with a full refund or credit, often provisionally during the investigation itself.

Disputes involving P2P apps, authorized-but-fraudulently-induced transfers, or claims of gross negligence are considerably harder and less reliably resolved in the consumer’s favor, since the core liability protections are generally built around "unauthorized," not "regretted," transactions.

This page can help identify your liability tier and the deadlines that apply — it cannot predict whether your specific bank will accept your account of events, whether a P2P transfer will be treated as unauthorized, or what a regulator will find if you escalate.