What Federal Law Says About Unauthorized Credit Card Charges
When someone uses your credit card without permission, Regulation Z — the federal rule that implements the Truth in Lending Act — strictly limits how much of that loss can be passed to you. Under 12 CFR § 1026.12(b), a cardholder’s liability for a series of unauthorized uses cannot exceed $50, or the value obtained through the unauthorized use before the card issuer is notified, whichever is less (CFPB — 12 CFR § 1026.12).
That means if a thief spends $2,000 before you call your bank, federal law still caps your personal exposure at $50. If you notify the issuer before any fraudulent charges occur, your liability is zero.
Many card issuers voluntarily advertise a “$0 fraud liability” policy, but that is a contractual benefit — the $50 ceiling is a federal floor that exists regardless of what any card agreement says.
How Regulation Z Defines “Unauthorized Use”
The $50 cap applies only to charges that qualify as “unauthorized use” under the regulation’s specific definition.
Regulation Z defines unauthorized use as use of a credit card by a person, other than the cardholder, who does not have actual, implied, or apparent authority for such use, and from which the cardholder receives no benefit (eCFR — 12 CFR § 1026.12).
Two parts of that definition matter in practice:
- No authority of any kind. A family member or friend you previously allowed to use your card may have implied or apparent authority, which could take a transaction outside the definition.
- No benefit to the cardholder. If the cardholder indirectly benefited from the transaction, the use may not qualify as unauthorized under the rule.
When the $50 Cap Actually Applies: Required Conditions
The $50 cap is not automatic in every situation. A cardholder is liable for unauthorized use only if the card issuer previously provided adequate notice of two things (CFPB — 12 CFR § 1026.12):
- The cardholder’s maximum potential liability (i.e., the $50 limit itself), and
- The means by which the card issuer may be notified of loss or theft.
If the issuer failed to provide that adequate notice, the cardholder’s liability is zero, even for charges that would otherwise be within the $50 cap.
| Condition | Result if Met | Result if Not Met |
|---|---|---|
| Issuer gave adequate liability notice | $50 cap applies | Cardholder owes nothing |
| Cardholder notified issuer before unauthorized use | Cardholder owes nothing | $50 cap may apply |
| Unauthorized user had no authority and cardholder got no benefit | Charges are “unauthorized use” | Charges may not be covered |
How to Notify Your Card Issuer
One of the most consumer-friendly aspects of Regulation Z is its flexible notification rule. Notice of unauthorized use to the card issuer may be given in any reasonable manner — by mail, telephone, or personal visit — and may be oral or written (eCFR — 12 CFR § 1026.12).
Critically, notice is effective even if it is not given to a specific person within the issuer’s organization, or at the address or phone number the issuer disclosed (CFPB — 12 CFR § 1026.12). In practical terms, this means a general call to customer service counts — you do not need to locate a dedicated fraud department or send a certified letter to a specific address to trigger your protections.
Practical steps consumers typically take when notifying an issuer:
- Call the number on the back of your card (or any reachable customer-service line) as soon as you identify an unauthorized charge.
- State clearly that you are reporting unauthorized use and request a case or reference number.
- Follow up in writing (email or letter) to create a record of the date and content of your notice.
- Keep records of all communication — dates, times, names of representatives, and confirmation numbers.
- Review your account statements to identify the full scope of unauthorized charges and confirm which transactions meet the regulatory definition.
- If the issuer disputes your claim or fails to act, consumers have the right to escalate through the CFPB complaint process or seek further help — you can start a claim at BEST-AI-LAWYER to understand your next steps.
What Falls Outside the $50 Cap
Not every disputed charge is an “unauthorized use” under Regulation Z. Charges outside the cap’s protection include:
- Transactions made by someone the cardholder voluntarily gave the card to, even temporarily (actual or implied authority).
- Transactions where the cardholder received a benefit from the purchase.
- Billing errors — such as duplicate charges or wrong amounts — which are governed by a separate dispute process under the Fair Credit Billing Act, not the unauthorized-use cap.
Understanding that distinction matters when deciding how to frame a dispute with your issuer. Consumers facing billing errors rather than outright unauthorized use have a different set of procedural rights and deadlines under federal law.
FAQ
Does the $50 cap apply to debit cards?
No. The $50 cap under 12 CFR § 1026.12 applies specifically to credit cards. Debit cards are governed by the Electronic Fund Transfer Act and Regulation E, which have a different — and generally less favorable — liability structure that depends on how quickly the cardholder notifies the bank.
Can a card issuer hold me liable for more than $50 for unauthorized credit card charges?
Under 12 CFR § 1026.12(b), a cardholder’s liability for a series of unauthorized uses of a credit card cannot exceed $50, or the value obtained through the unauthorized use before the card issuer is notified, whichever is less (CFPB — 12 CFR § 1026.12). An issuer cannot impose a higher liability than the federal rule allows, though issuers may voluntarily reduce it further.
What if I gave someone my card and they charged more than I authorized?
If the person had actual, implied, or apparent authority to use the card, those charges may not qualify as “unauthorized use” under Regulation Z’s definition, which requires the user to have no actual, implied, or apparent authority. Charges beyond an agreed limit in that scenario may instead be a civil matter between the cardholder and the other person.
Does it matter how I notify the card issuer — phone vs. letter?
No. Regulation Z states that notice may be given in any reasonable manner — by mail, telephone, or personal visit — and may be oral or written (eCFR — 12 CFR § 1026.12). The method does not affect whether your notification is legally effective, though keeping written records of any notice is good practice.
What if the issuer says it never received my notification?
Under 12 CFR § 1026.12, notice is effective even if it is not given to a specific person within the issuer’s organization, or at the address or phone number the issuer disclosed (CFPB — 12 CFR § 1026.12). Consumers who maintain records of their notification — dates, reference numbers, representative names — are better positioned to demonstrate that notice was given. If a dispute with the issuer cannot be resolved directly, consumers can file a complaint through BEST-AI-LAWYER to explore their options.
Is there a deadline to report unauthorized charges?
The verified data for 12 CFR § 1026.12 does not specify a reporting deadline for the unauthorized-use cap. The cap simply reduces as the value obtained through unauthorized use increases before notification — meaning earlier notice results in lower (or zero) liability. Consumers should check their cardholder agreement and applicable CFPB guidance for any additional timeframes that may apply.
Content last verified against regulatory sources: June 20, 2026. This page provides factual and procedural information only. BEST-AI-LAWYER is not a law firm and does not provide legal advice.
Frequently asked questions
Does the $50 cap apply to debit cards?
No. The $50 cap under 12 CFR § 1026.12 applies only to credit cards. Debit cards are governed by the Electronic Fund Transfer Act and Regulation E, which use a different liability structure based on notification timing.
Can a card issuer hold me liable for more than $50 for unauthorized credit card charges?
No. Under 12 CFR § 1026.12(b), cardholder liability for unauthorized use cannot exceed $50, or the value obtained before the issuer is notified, whichever is less. Issuers may voluntarily reduce this amount further but cannot exceed it.
What if I gave someone my card and they charged more than I authorized?
Regulation Z's unauthorized-use definition requires the user to have no actual, implied, or apparent authority. A person you voluntarily gave your card to may have implied authority, which could place those charges outside the $50 cap's protection.
Does it matter how I notify the card issuer — phone vs. letter?
No. Regulation Z allows notice in any reasonable manner — by mail, telephone, or personal visit — and permits oral or written notice. The method does not affect whether the notification is legally effective.
What if the issuer says it never received my notification?
Under 12 CFR § 1026.12, notice is effective even if not given to a specific person or at the issuer's disclosed address or phone number. Keeping records of notification dates, reference numbers, and representative names helps document that notice was given.
Is there a deadline to report unauthorized charges under Regulation Z?
The regulation does not specify a fixed reporting deadline for the unauthorized-use cap. However, liability is limited to the value obtained before the issuer is notified, so earlier notification results in lower or zero liability.