Inside the chapter: Account Compromise: Why Speed Sets the Size of Your Loss

In summary

This is part 2 of 2 of our guide to The Account-Compromise Playbook. It picks up where Bank Account Hacked? What to Do in Ten Steps leaves off, and it is written to stand on its own: the key ideas are restated where you need them.

Regulation E’s official commentary states that your liability “is determined solely by the consumer’s promptness in reporting,” and that negligence, such as writing the PIN on the card, “cannot be used as the basis for imposing greater liability.” The logic is about who can act. Once told, the bank can block a card or account in seconds; before it is told, only you can know something is wrong. So the rule prices the one thing you control, the timing of your notice, in three tiers: up to $50, up to $500, and unlimited for transfers after the 60-day statement window that prompt notice would have prevented. The clocks bend only for “extenuating circumstances” such as extended travel or a hospital stay, when the bank must extend them to a reasonable period.

The paperwork rules follow the same logic. The bank must start investigating on a phone call and may not wait for documents, but it may require written confirmation within 10 business days, and if you skip that it need not give a provisional credit. For a transfer made within 30 days of an account’s first deposit, the 10-business-day deadline becomes 20, and the longest investigation becomes 90 days instead of 45.

Your debit card is stolen on a Monday (day 0) and you notice that evening. The thief takes $500 on day 0 and $500 on day 1, then $400 every Friday. The first statement showing the theft is sent on day 30, so its 60-day window closes on day 90. Your share under Regulation E depends only on when you report:

The flip points: the second business day after you learn of the theft, when your maximum jumps from $50 to $500, and day 90, after which every further withdrawal, $400 a week here, is yours. The day-120 cost of $2,100 is about one net paycheck for the running household ($2,163.60). If the thief had used only your account number, with no card lost, the $50 and $500 tiers would not apply: reporting within the 60-day window would cost you nothing.

The ten steps assume a consumer checking or card account and a stranger as the thief. These situations change who pays, or which clock runs.

Handling a compromise is like finding a burglar has copied your keys. Mopping up the mess comes later; first you change the locks — starting with the master key (email) and the spare under the mat (your phone number) — so they can’t come back tonight.

Federal liability limits protect consumers who report promptly, and the protection shrinks as days pass. A household that has practiced this list — knows where its bank’s fraud number is, uses a password manager, and has freezes already in place — turns a potential catastrophe into an afternoon of phone calls.

Order: if money can still leave, freeze the cards first; then, if the attacker may still reach your email or phone number, secure those before changing any other password. Clocks: report any lost card or unauthorized debit within two business days of learning of it; confirm a phone report in writing within 10 business days; dispute anything on a statement within 60 days of the date it was sent, and a credit card charge within 60 days of the first statement showing it. Escalate to a police report when a creditor asks for one, you know the thief, or the loss exceeds what you could absorb from your emergency fund. If your phone shows no service for no reason you know of, call the carrier from another phone the same hour.

Assumptions: a consumer account at a U.S. bank or card issuer, covered by Regulations E and Z. Ignore the clocks’ comfort for business accounts, brokerage accounts, paper checks and wires, where 13.4’s edge cases apply and only the institution’s agreement or state law protects you; there, report within hours.

1. A thief takes $400 with your stolen debit card before you notice, then $700 more after the second business day after you learn of the theft. Under Regulation E, how much more do you lose by reporting on day six rather than within two business days?