This article does not constitute legal advice or a legal opinion. If you plan to take legal action based on this article, please consult your legal counsel first.
Friends who have just arrived in the U.S. from China are often alarmed by how American payment systems work: you can swipe a credit card without entering a PIN, and transfers may only require a bank account number and routing number. This system makes it easy for credit cards to be used fraudulently and for bank deposits to be stolen. If you suddenly notice an unfamiliar transaction on your bank account or credit card, what should you do? No one wants this to happen. But once it has happened, you should move quickly to get your money back. Today we’ll summarize how to deal with stolen bank funds and unauthorized credit card charges, and how to prevent these incidents.
Since credit cards and bank accounts are governed by different laws, we will discuss the two situations separately.
Contents [Hide]
Credit Card Fraud in the U.S.
Credit card fraud is governed by the Fair Credit Billing Act of 1974. Under 15 U.S.C. § 1643, for unauthorized use of a credit card, the cardholder is liable for no more than $50. If only the card number was stolen and the fraud was conducted as a card-not-present transaction over the internet or by phone, the cardholder is not liable. In practice, because $50 is a relatively small amount, nearly all U.S. credit card issuers waive that $50 for personal credit cards, meaning the issuer bears the full loss. Please note that many business credit cards do not automatically provide $0 fraud liability protection, so you should check your card’s guide.
What to Do
If you notice an unfamiliar transaction, do not panic right away. First, you can search the merchant name and address on Google. Don’t laugh—there are plenty of cases where people forget they authorized a transaction. If you investigate and confirm that it really is not your transaction, do not worry, but you must immediately call your credit card company to report the fraudulent charge. The credit card company will usually ask related questions and may give you instructions, such as filing a police report at your local police station and obtaining a report number, or signing a statement that the transaction was not made by you.
After that, the credit card company will begin an investigation. During the investigation, you may withhold payment on the disputed charge, but you still must pay any undisputed charges. Even so, we recommend paying the statement balance in full, because the credit card company may in theory report the existence of the disputed bill to the credit bureaus (though it may not report, or threaten to report, Late Payment or Delinquent to the credit bureaus), and if the dispute is unsuccessful, the charge will accrue interest.
After the credit card company completes its investigation, it will usually, barring unusual circumstances, decide in your favor and remove the charge from the statement. If the credit card company denies your claim, it has a legal duty to tell you why. If you are unhappy with the credit card company’s decision, you can file a complaint with the Federal Trade Commission (FTC). The FTC is a quasi-judicial agency that independently weighs the facts and makes a decision. Alternatively, if the amount is significant, you may also consider bringing the matter directly under 15 U.S.C. § 1640 (e) in federal district court or another court with appropriate jurisdiction (state court). Choosing the proper court and filing suit involve complex legal issues, so if necessary, you should seek a lawyer’s help. We won’t go into that here.
Exceptions to $0 Fraud Liability
In general, credit cards that offer $0 liability require the account to be in good standing, which means that if you have not paid at least the minimum payment, you may not qualify for $0 fraud liability. However, the statutory $50 liability cap still applies. If the credit card company can prove that the fraud loss resulted from your own actions, you may also be required to pay the full fraudulent amount. So we emphasize again: after fraud occurs, you should notify the credit card company as quickly as possible.
Related Articles on This Site
We previously published articles about credit card fraud, though with a different focus. You may also find these helpful:
- Why Was My Credit Card Charged Fraudulently? What Should I Do?
- A Story About Unauthorized Charges on a Chase Credit Card
Credit Card Fraud on a China-Issued Card
If the card that was fraudulently used is a credit card issued in China, or a supplementary card tied to it, then you cannot benefit from the fraud liability protections described above. The reporting process is similar, but after you report the fraud, Chinese banks often require you to go to a nearby ATM and check the balance using your own credit card, or ask for a scanned copy of your passport to prove that you were in possession of the card when the fraud occurred.
Of course, it is also common for domestic banks to act unreasonably and try to make you pay the bill yourself, so you should be prepared for a long battle. If necessary, you can sue the bank in the People’s Court. We recommend that when you are overseas, you use your U.S. credit card for purchases and keep your Chinese credit card (or supplementary card) in a drawer, because U.S. cardholders enjoy more comprehensive protections. Even for purchases in China, you can use cards such as Discover it and Chase Sapphire Preferred, which do not charge a foreign transaction fee. U.S. credit cards enjoy the same protections against fraud abroad as they do in the U.S.
Debit Card Fraud or Theft from a Checking/Savings Account
Because credit cards and debit cards are different products, the laws that regulate them are also different. Below is our summary of the Electronic Fund Transfer Act of 1978 and the implementing regulation adopted under that law (12 C.F.R. 205.6):
| Access device (debit card) | When you notify the bank | Liability limit |
|---|---|---|
| Lost debit card | Before the fraud occurs | $0 liability |
| Lost debit card | Within 2 business days after learning the card was lost | $50 or the actual fraudulent amount, whichever is smaller |
| Lost debit card | More than 2 business days after learning the card was lost, but within 60 days after receiving the statement showing the fraud | $50 or the actual fraudulent amount within 2 business days after learning the card was lost, whichever is smaller, plus all fraudulent amounts from after the 2-business-day period until you notify the bank. If the total exceeds $500, then the limit is $500. |
| Lost debit card | More than 60 days after receiving the statement showing the fraud | The portion fraudulently charged within 60 days is calculated under the previous row; after 60 days, you bear unlimited losses. |
| Transactions not involving the debit card | Within 60 days after receiving the statement showing the fraud | $0 liability |
| Transactions not involving the debit card | Within 60 days after receiving the statement showing the fraud | No liability for fraud within 60 days; unlimited losses after 60 days. |
As you can see, a customer’s liability for stolen bank funds is closely tied to when the bank is notified. Therefore, if you discover that your debit card is missing, you must call the bank right away to minimize your potential losses. The good news is that if the theft happened through ACH, then because the routing number and account number are not an Access device as defined in 12 C.F.R. 205.2, you will not be liable for any loss as long as you report it to the bank within 60 days after the statement is issued. Similarly, if you are not satisfied with the bank’s final decision, you may consider filing a complaint with the FTC or going to court.
Best Practices: Protect Yourself from Theft
Check Your Statements Often
The easiest and most important thing you can do is regularly review your credit card and bank statements. A few easy ways to do this are:
- Set up transaction alerts on all bank and credit card websites so that you automatically receive an email or text message whenever a purchase occurs.
- Use Mint or similar products to track all of your accounts.
As soon as you spot an unauthorized transaction, notify the bank or credit card company immediately. This is the most important step.
Handle Sensitive Documents Carefully
When discarding statements or voided checks, make sure to destroy any personal information on them. The account number and routing number on a check are sensitive information, and if you simply throw these documents into the trash, someone may pick them up.
Use a Virtual Card Service for Online Purchases
Citi credit cards allow you to open a virtual card number online for online purchases. After you finish the purchase, you can deactivate the virtual card. That way, even if the virtual card number is stolen, it cannot be used for purchases.
Use Third-Party Payment Platforms
For purchases on unfamiliar small websites, unless you have a better cash-back offer, you should try to use services such as PayPal, Visa Checkout, MasterPass, and AMEX Express Checkout when making purchases, because the security protections on these small websites are generally not as good as those of larger, reputable sites.
Conclusion
In the U.S., the laws related to fraud are fairly well developed, and major banks all have warning systems for fraud or other suspicious activity. So the next time your card is declined, don’t get too worked up—it may well be that when your card is stolen next time, you’ll be thankful for those protections.