An unauthorized debit card charge is an electronic fund transfer (EFT) you did not approve: stolen card data, a skimmer, or account takeover that swipes or taps your debit card. This guide follows the debit / Regulation E path through your bank or credit union. It is not the ACH bank-pull guide (Unauthorized ACH debit), not the general credit-vs-debit overview (Unauthorized card charges), and not a broad bank-error notice walkthrough (Bank errors within Regulation E).
Debit Reg E vs credit vs ACH
| Rail | Typical rule set | First call |
|---|---|---|
| Debit card (swipe, tap, online debit) | Reg E unauthorized EFT via your bank | Number on the debit card / bank fraud line |
| Credit card | FCBA / card-network paths | Number on the credit card |
| ACH pull (routing/account harvesting) | Reg E via bank, different originator block steps | Bank fraud line; see ACH guide |
If the same thief hit debit and ACH, open both disputes. One claim does not cover the other rail.
First 48 hours (debit-focused)
- Lock the debit card in the Chase, Bank of America, Wells Fargo, Capital One, Ally, or credit-union app.
- Call the fraud number on the back of the debit card (or the number on your statement). Say the charges are unauthorized.
- Ask for a replacement card and whether provisional credit applies while they investigate.
- List each bad debit with date, amount, merchant name, and whether it was in-person, online, or ATM.
- Change online banking and email passwords if phishing is possible; enable MFA (Phishing and account takeover).
- Review ATM and pump habits if skimming is likely (Skimming and card cloning).
- Watch linked accounts the same day for follow-on ACH or credit-card hits.
Pay any undisputed scheduled bills from a backup method so rent does not fail while the card is locked.
Reg E reporting and investigation deadlines
Under Reg E, two notice clocks matter: (1) for a lost or stolen access device, notify within two business days after you learn of the loss to keep liability lower for later unauthorized transfers; (2) for many unauthorized EFTs, notify within 60 calendar days after the statement that shows the error was sent (or otherwise made available). Act the same day you notice fraud, but do not treat “first 48 hours” as a substitute for the two-business-day rule.
Banks generally must investigate within 10 business days or provisionally credit you while they continue (longer windows can apply: often 20 business days for new accounts; investigations may run up to 45 calendar days, or 90 for some point-of-sale/foreign debit cases). Missing a bank’s requested written confirmation within 10 business days can affect provisional credit. A deposit agreement can improve protections; it does not raise your liability above Reg E. Ask for your bank’s coding and dates, but the federal clocks are not set by the agreement alone.
Do not rely on memory of a single number. Ask in secure message:
- Are these coded as unauthorized debit-card EFTs under Reg E?
- What notice deadline applies to my case?
- When will provisional credit post if it applies?
- Do you need a written affidavit?
For written error-notice mechanics beyond stolen-card debit, see Dispute a bank error within Regulation E.
Worked example
Priya sees a $212.47 debit at a big-box store two states away and two $1.00 test charges online. She did not travel and still has her physical card. Same day she locks the debit card in the Capital One app, calls the fraud line on the card, and files unauthorized EFT claims on all three. The bank ships a new debit card and quotes provisional credit timing in the confirmation email.
Priya also freezes credit at Equifax, Experian, and TransUnion in case the thief tries new credit (Credit freezes and fraud alerts). She does not wait for the monthly PDF because the app already shows the posts.
What not to mix in
- Merchant item never arrived on a debit purchase you did authorize: still contact the merchant, then ask the bank what debit dispute options exist; it may not be “unauthorized.”
- ACH gym pull with no card network ID: use the ACH unauthorized path.
- Credit card foreign charge: use the credit dispute channels in Unauthorized card charges.
Checklist
- Lock the debit card; call the number on the card the same day.
- File unauthorized EFT disputes for each debit-card charge.
- Request replacement card and written claim numbers.
- Change passwords / MFA if ATO is possible.
- Calendar the bank’s stated investigation and provisional-credit dates.
- Freeze credit and scan other accounts if the pattern looks wider.
Educational only. Not legal or banking advice. Reg E and bank procedures have details and exceptions; confirm with your institution and CFPB electronic fund transfer materials.