Debit vs. Credit Card Disputes: 2026 Consumer Rights Guide

Your debit card and your credit card look almost identical in your wallet — same plastic, same Visa or Mastercard logo, same chip and tap-to-pay. They are not, however, governed by the same law, and that single difference is worth roughly $450 of protection on every unauthorized charge and 30 to 60 extra days to catch the problem. Debit card disputes fall under the Electronic Fund Transfer Act (EFTA, 15 U.S.C. §§ 1693 et seq.) and its implementing rule, Regulation E. Credit card disputes fall under the Truth in Lending Act and the Fair Credit Billing Act (FCBA, 15 U.S.C. §§ 1666 et seq.), implemented by Regulation Z. The acronyms are dry. The dollar consequences are not. This is the 2026 side-by-side comparison — every deadline, every liability cap, every "burden of proof" wrinkle — pulled verbatim from the statutes themselves.

Table of Contents

1. TL;DR: The Numbers That Matter
2. Two Different Statutes for Two Different Plastics
3. The Liability Ladder: $50, $500, Unlimited
4. The 60-Day Clock — Same Number, Different Meanings
5. Bank Investigation Deadlines: 10 Days vs. 30 Days
6. Who Has to Prove What
7. "Goods Not Delivered" — The Hidden Credit Advantage
8. P2P, Zelle, Cash App, and the EFTA Gray Zone
9. The Step-by-Step Dispute Process for Each Card
10. Disputes That Usually Win vs. Usually Lose
11. Recurring Charges and the "Authorized Once" Trap
12. Practical Rules This Translates Into
13. How Purchy Tracks Both Clocks
14. Frequently Asked Questions

TL;DR: The Numbers That Matter

What's on the line	Debit card (Reg E)	Credit card (Reg Z)
Statute	EFTA §§ 1693f, 1693g	TILA § 1643, FCBA §§ 1666, 1666i
Max liability if reported in 2 business days	$50	$50 (always)
Max liability if reported 2 business days – 60 days	$500	$50
Max liability if reported after 60 days	Unlimited (for charges after day 60)	$50 (but you may lose dispute rights)
Window to dispute a billing error	60 days from statement	60 days from statement
Bank's investigation deadline	10 business days (or 45 with provisional credit)	30 days to acknowledge, 90 days to resolve
Provisional credit required?	Yes, if investigation exceeds 10 days	No (most issuers give it anyway)
"Goods not delivered" / "not as described" covered?	No federal right (only card-network rules)	Yes, under § 1666i (purchases over $50)
Burden of proof	On the bank (§ 1693g(b))	On the issuer (§ 1643(b))

If you remember one sentence from this guide: your debit card is your money, your credit card is the bank's money, and the law was written that way on purpose.

Two Different Statutes for Two Different Plastics

Federal consumer-protection law does not have a single chargeback regime. Congress wrote one law for credit cards in 1974 (the Fair Credit Billing Act, layered on top of 1968's Truth in Lending Act) and a different law for everything that moves money electronically in 1978 (the Electronic Fund Transfer Act). When the debit card became ubiquitous in the 1990s, it was the EFTA framework that swallowed it, not the FCBA. The result is two parallel dispute systems with different deadlines, different caps, and different burdens — even though to a consumer both transactions look like "I tapped a card at a register."

Regulation Z (12 CFR Part 1026) implements TILA and FCBA. Regulation E (12 CFR Part 1005) implements EFTA. Both are now administered by the Consumer Financial Protection Bureau. The card networks (Visa, Mastercard, American Express, Discover) layer their own "chargeback" rules on top of both — those network rules are contractually richer in some ways (Visa's reason-code catalog covers things the FCBA does not, like "merchandise counterfeit") but they are not federal law. If a network rule and the statute conflict, the statute wins for U.S. consumers. The network rules are useful, however, because they are how most disputes actually get adjudicated in practice — your card issuer files a chargeback through the network, the merchant either accepts or "represents" with evidence, and the network arbitrates.

The Liability Ladder: $50, $500, Unlimited

This is the single biggest gap between the two regimes, and the one that costs consumers the most money. Credit card unauthorized-use liability is capped at $50 flat under 15 U.S.C. § 1643(a)(1)(B), "in no event" exceeding that amount, and only if a list of conditions is met (the card was an "accepted credit card," the issuer gave notice of liability, the issuer provided a means to report loss, etc.). In practice, every major U.S. issuer — Chase, Amex, Capital One, Citi, Discover, Bank of America — has voluntarily zeroed-out the $50 too, marketed as "zero liability." That is a network-level promise, not a statutory one, but it has held since the late 1990s.

Debit card liability is a three-step ladder defined verbatim in 15 U.S.C. § 1693g(a):

1. $50 maximum if you report the loss or theft within two business days of learning of it. This is the statutory floor and it matches the credit card cap.
2. $500 maximum if you wait longer than two business days but report within 60 days of the statement that first shows the unauthorized transfer. The statute reads: "the consumer's liability under this subsection in any such case may not exceed a total of $500, or the amount of unauthorized electronic fund transfers which occur following the close of two business days … but prior to notice to the financial institution under this subsection, whichever is less" (§ 1693g(a)).
3. Unlimited liability for any unauthorized transfer that occurs after the 60-day mark, if the consumer failed to report a prior unauthorized transfer that appeared on a periodic statement. The exact words: "reimbursement need not be made to the consumer for losses the financial institution establishes would not have occurred but for the failure of the consumer to report within sixty days of transmittal of the statement … any unauthorized electronic fund transfer or account error which appears on the periodic statement."

That third tier is the scary one. If a thief skims your debit card on March 1, makes a $200 charge that posts to your March statement, and you don't notice it until July, then every additional unauthorized charge that hit your account after the 60-day window closed (roughly early May) can come out of your bank account with no statutory cap. The bank's only obligation is to prove that those later losses "would not have occurred but for" the consumer's failure to report — typically a low bar, because the bank can argue it would have shut down the card if notified.

"Extenuating circumstances" — the statute lists "extended travel or hospitalization" — extend the 60-day window to "a reasonable time under the circumstances." Reg E also gives consumers in their first 30 days of holding a new account a longer window (12 CFR § 1005.11(b)(1)(i)). But unless one of those carve-outs applies, the 60-day clock is hard.

The 60-Day Clock — Same Number, Different Meanings

Both regimes use "60 days" but they measure from the same starting point (the date the financial institution transmits the periodic statement showing the disputed transaction) for different purposes. Under FCBA § 1666(a), the 60 days is your deadline to send the creditor a written "billing error" notice. Under EFTA § 1693f(a), it is also 60 days, but the notice can be oral or written, and the consequences of missing the window are different.

For credit cards, missing the 60-day FCBA window doesn't end your card-network chargeback rights. Visa's reason codes typically allow 120 days from the transaction or expected delivery date (Mastercard is similar, with some codes going to 540 days). But the federal-law protection — the part that requires the issuer to suspend collection during the investigation and forbids it from reporting the disputed amount as delinquent (§ 1666a) — is what you lose. After day 60, your dispute lives or dies on whatever the card network's rules say and whatever the issuer's customer-service team feels like doing.

For debit cards, missing the 60-day window has a sharper consequence: it triggers the "unlimited liability" tier described above for any further unauthorized transfers. Existing unauthorized transfers reported late are still subject to the $500 ceiling, but the meter starts running on day 61 for any transfer that "would not have occurred but for" the failure to report.

Bank Investigation Deadlines: 10 Days vs. 30 Days

Once you file the dispute, the two regimes diverge again. EFTA § 1693f imposes a strikingly tight clock on debit card issuers: the financial institution must investigate the alleged error and "report or mail the results of such investigation and determination to the consumer within ten business days." If the bank cannot finish in 10 business days, it has one alternative: provisionally recredit the consumer's account for the full disputed amount and take up to 45 days to conclude the investigation (§ 1693f(c)). During the provisional-credit period, "the consumer shall have full use of the funds." For point-of-sale or foreign-initiated transactions, the outer limit extends to 90 days, but the provisional-credit requirement still kicks in at day 10.

FCBA § 1666 gives credit card issuers a longer leash: the creditor must acknowledge a written billing-error notice within 30 days of receipt, and must resolve the dispute within two complete billing cycles or 90 days, whichever is less. There is no statutory provisional-credit requirement on the credit side — though Reg Z does forbid the issuer from collecting the disputed amount, charging interest on it, or reporting it as delinquent while the investigation is pending (§ 1666a). Most issuers post a provisional credit anyway as a customer-service gesture, but they are not legally required to.

The net effect: a debit card dispute, properly filed, gets your money back into your account within 10 business days or your bank breaks federal law. A credit card dispute can take up to three months, during which you simply don't have to pay the disputed amount.

Who Has to Prove What

Both statutes place the burden of proof on the financial institution, not the consumer. EFTA § 1693g(b) is explicit: "In any action which involves a consumer's liability for an unauthorized electronic fund transfer, the burden of proof is upon the financial institution to show that the electronic fund transfer was authorized." TILA § 1643(b) mirrors this for credit cards: "In any action by a card issuer to enforce liability for the use of a credit card, the burden of proof is upon the card issuer."

What "burden of proof" means in practice depends on whether you ever get to a courtroom. For 99% of disputes, the burden plays out as an internal bank-investigation standard, not litigation. But the statutory placement matters when issuers send threatening collection letters or report a charge-off on a disputed balance — you can point to § 1666a for credit and § 1693g(b) for debit and force them to substantiate.

"Goods Not Delivered" or "Not As Described" — The Hidden Credit-Card Advantage

The most underrated FCBA provision is one almost no consumer knows by name: 15 U.S.C. § 1666i, "Assertion by cardholder against card issuer of claims and defenses arising out of credit card transaction." This is the U.S. analog to the UK's Section 75 of the Consumer Credit Act, and it has no debit-card equivalent. It says that for any credit card purchase over $50 made in the same state as your billing address or within 100 miles of it, you can raise any contractual claim or defense you have against the merchant directly against the card issuer. If the merchant breached warranty, sold you defective goods, or failed to deliver, you can charge back the credit card and the issuer is on the hook for the merchant's failure.

Three prerequisites under § 1666i(a):

1. The cardholder made a "good faith attempt to obtain satisfactory resolution" from the merchant first.
2. The transaction amount exceeds $50.
3. The transaction occurred in the same state as the cardholder's mailing address or within 100 miles of it.

The geographic limitation has a giant loophole built right into the statute: prerequisites (2) and (3) are waived if the merchant "is the same person as the card issuer," is "controlled by the card issuer," is "under direct or indirect common control" with the issuer, is "a franchised dealer in the card issuer's products," or "has obtained the order for such transaction through a mail solicitation made by or participated in by the card issuer." That last clause — mail solicitation by the issuer — has been interpreted by federal courts to cover most online purchases where the issuer's network is the payment rail, effectively swallowing the 100-mile rule for e-commerce.

There is no analogous "claims and defenses" provision in EFTA. If a merchant ships you the wrong size sweater and refuses to take it back, your only debit-card remedy is the card-network chargeback (Visa reason code 13.3 "Not as described or defective merchandise," for example), and those rules are contractual — they can be modified, narrowed, or even repealed by the network at any time. Your credit card gives you a federal statutory backstop. Your debit card does not.

P2P, Zelle, Cash App, and the EFTA Gray Zone

Reg E covers "electronic fund transfers," which includes debit card transactions, ATM withdrawals, ACH, and — critically — most peer-to-peer transfers. The CFPB clarified in 2021 that consumer-initiated transfers through Zelle, Cash App, Venmo, and similar apps are EFTs, meaning consumers retain Reg E protections against unauthorized transfers. But there is a giant carve-out: Reg E does not protect you when you authorized the transfer and were tricked. The "I sent $2,000 to a scammer who claimed to be the IRS" cases are not "unauthorized" under § 1693a(11) — you initiated the transfer voluntarily, even under fraud. The transfer is authorized, just regretted.

This carve-out has produced the largest litigation cluster in EFTA history. Several U.S. senators have proposed amending the EFTA to cover "induced fraud" P2P scams, and a handful of state legislatures (New York and California most prominently) have explored bank-level disclosure duties on Zelle-related fraud — but at the federal level in May 2026, an authorized-but-induced P2P transfer is not a Reg E "unauthorized" transfer, and the bank owes you nothing under § 1693g.

A credit card has no equivalent vulnerability because credit cards don't push money out the door the same way; the card-network chargeback rules apply and § 1666 governs the underlying credit transaction. If you used a credit card to make what turned out to be a scam payment, you have FCBA dispute rights for the unrecognized merchant. If you sent the same dollars via Zelle from your checking account, you have very little.

The Step-by-Step Dispute Process for Each Card

Credit Card Dispute (FCBA Process)

1. Try the merchant first. Section 1666i requires a "good faith attempt to obtain satisfactory resolution" for claims-and-defenses disputes over $50. For pure billing-error disputes (charges you don't recognize, double-billings, computation errors), this step is not legally required, but issuers expect to see evidence of it.
2. Send a written billing-error notice within 60 days. Section 1666(a) requires the notice to (1) identify you and your account number, (2) state your belief that there is a billing error and the amount, and (3) set forth the reasons for your belief. Send it to the address listed on your statement for billing inquiries — not the payment address. Send by certified mail with return receipt; this is the gold-standard proof of date of receipt that triggers the 30/90-day clocks.
3. Issuer must acknowledge within 30 days. If it does not, that itself is a Reg Z violation actionable under 15 U.S.C. § 1640.
4. Issuer must resolve within two billing cycles or 90 days. Resolution means either correcting the account (with refund of any related finance charges) or sending a written explanation of why the issuer believes the charge is correct.
5. If denied, demand documentary evidence. Section 1666(a)(B)(ii) gives you the right to "copies of documentary evidence of the obligor's indebtedness" upon request.
6. Escalate to CFPB or state AG. The CFPB consumer-complaint portal forwards your complaint to the issuer with a 60-day company-response deadline.

Debit Card Dispute (Reg E Process)

1. Notify the bank — orally or in writing — as fast as possible. The 2-business-day clock for the $50 cap starts the moment you "learn of" the loss or theft. If the unauthorized transfer is one you spotted on a statement (not a card you noticed missing), the relevant clock is the 60-day statement window.
2. Provide identifying details. EFTA § 1693f(a) requires (1) your name and account number, (2) the amount and your belief there is an error, (3) the reasons for your belief. Oral notice is statutorily sufficient, but the bank may demand written confirmation within 10 business days.
3. Bank investigates within 10 business days OR provisionally credits. Section 1693f(c) is unambiguous: if the bank cannot finish in 10 business days, it must provisionally recredit the disputed amount and take up to 45 days to conclude (90 days for POS or foreign-initiated transactions).
4. If the bank finds an error, it corrects within 1 business day (§ 1693f(b)) and credits any interest where applicable.
5. If the bank finds no error, it must mail you an explanation within 3 business days of concluding (§ 1693f(d)) and, upon request, provide reproductions of the documents it relied on.
6. Treble damages are available under § 1693f(e) and § 1693m if the bank fails to provisionally credit or knowingly refuses to credit despite a complete investigation showing error.

Disputes That Usually Win vs. Usually Lose

Usually win (either card): charges from merchants you have no relationship with, exact-duplicate charges on the same day, charges after a confirmed subscription cancellation (keep the cancellation email), charges for goods that never arrived (credit card via § 1666i; debit only if network rules apply), ATM withdrawals you didn't make.

Usually lose: "buyer's remorse" — you regret the purchase but it was authorized and delivered as described; charges where the merchant has a signed receipt or PIN entry; cash advances and ATM withdrawals on a debit card where you authorized the transfer even if to a scammer (Zelle/Cash App pull-style transfers); recurring charges you forgot to cancel within the merchant's cancellation window; gift card or prepaid card top-ups that were then drained.

The gray zone is "merchandise not as described" on a debit card — federal law gives you no right, but Visa and Mastercard reason codes do. Outcomes there depend heavily on the quality of your evidence (photos, original listing screenshots, communications with the merchant).

Recurring Charges and the "Authorized Once, Authorized Forever" Trap

Reg E § 1005.10(c) gives consumers the right to stop preauthorized electronic fund transfers (recurring debit transactions like gym memberships or streaming services) by notifying the bank "orally or in writing at any time up to three business days before the scheduled date of the transfer." The bank may require written confirmation within 14 days of an oral stop-payment request. Stopping the next withdrawal does not, however, cancel the underlying contract with the merchant — that requires separate action with the company.

For credit cards, the FTC's revised Negative Option Rule (16 CFR Part 425) was finalized in late 2024 and attempted to require "click to cancel" symmetry — if you could sign up online, you could cancel online. A federal appeals court vacated the rule's substantive provisions in summer 2025 on procedural grounds (the agency had not conducted the preliminary regulatory analysis required by 15 U.S.C. § 57b-3(b)). The disclosure-and-consent provisions of the existing rule remained in effect. Several states — California's Automatic Renewal Law, New York's General Business Law § 527-a, and Illinois' Automatic Contract Renewal Act among them — impose stricter cancellation requirements that are unaffected by the federal vacatur, so for state-resident consumers the click-to-cancel right is largely intact.

If a merchant continues to charge a card after you cancelled, both Reg E (for debit) and FCBA (for credit) treat the post-cancellation charges as unauthorized. Save the cancellation confirmation; it is the single most important piece of evidence in a recurring-charge dispute.

Practical Rules This Translates Into

1. Use your credit card for any purchase over $50 where delivery is delayed, the merchant is unfamiliar, or the product is high-risk for "not as described." Section 1666i is a moat your debit card does not have.
2. Use your credit card for travel, hotels, car rentals, and concert tickets. These have the highest dispute volume in the U.S. economy, and FCBA gives you the bigger toolkit.
3. Use your debit card for in-person purchases at trusted merchants where you can hand-inspect. Grocery stores, pharmacies, the gas station you've been going to for 10 years.
4. Check your debit card statements within 60 days, no exceptions. Set a recurring calendar reminder. The unlimited-liability tier in § 1693g(a) is the single most expensive consumer-finance penalty in U.S. law for inattention.
5. For new debit card unauthorized charges, call the bank the same day, in writing if possible. The 2-business-day clock for the $50 cap is the only thing standing between you and the $500 tier.
6. Never use Zelle, Cash App, or Venmo to pay strangers. "Authorized but induced" P2P transfers are the single biggest unprotected category in U.S. consumer payments as of May 2026.

How Purchy Tracks Both Clocks

Every dispute right described above has a hard deadline measured in days, and every deadline is anchored to a specific date — usually a statement transmittal date that few consumers track in real time. Purchy reads your purchase confirmation emails and surfaces every receipt with its associated dispute window: the 60-day FCBA clock for credit cards, the 60-day Reg E clock for debit, the 100-mile § 1666i waiver flag for online merchants, and the 45-day provisional-credit deadline for any active dispute. If a refund is overdue, Purchy knows. If a recurring charge survived cancellation, Purchy flags it. The point is not to teach every consumer statutory law — it's to make sure no statutory deadline expires without you noticing.

For more on adjacent topics:

• How to dispute a credit card charge (the FCBA process step-by-step)
• How long does a refund take in 2026?
• How to get a refund for a forgotten subscription charge
• Buy Now Pay Later returns and refunds 2026
• The warranty-tracking guide for refundable defects
• Restocking fees 2026 — when they're legal and when they're not

Frequently Asked Questions

Is a debit card chargeback the same as a credit card chargeback?

No. A "chargeback" is the card-network's term for reversing a transaction. The networks (Visa, Mastercard, Amex, Discover) run chargebacks for both debit and credit. But the underlying federal protections are different statutes: Reg E for debit, Reg Z for credit. The network chargeback rules sit on top of those statutes and are negotiated contractually. The statutory layer is what protects you when the network rules fail.

Can I dispute a debit card charge after 60 days?

Sometimes. The 60-day Reg E window protects you from "unlimited liability" for future unauthorized charges, but it does not extinguish your right to ask the bank to investigate. Most banks will still process disputes filed after 60 days under their card-network rules, and Visa's debit-card chargeback windows generally allow 120 days from the transaction. The bank is no longer federally compelled to credit you for losses occurring after day 60, however.

What is "Regulation E" and where can I read it?

Regulation E is 12 CFR Part 1005, the Consumer Financial Protection Bureau's implementing rule for the Electronic Fund Transfer Act. The full text is available free at the eCFR. Section 1005.6 covers liability, 1005.11 covers error resolution.

If I tap with Apple Pay or Google Pay, which rules apply?

Whichever card is loaded into the wallet. Apple Pay using your debit card invokes Reg E. Apple Pay using your credit card invokes Reg Z. The mobile wallet is just a tokenization layer; the underlying card determines the dispute regime.

My bank says I have to file the debit dispute in writing. Is that required?

Under § 1693f(a), oral notice is sufficient to trigger the bank's investigation duty. However, the bank "may require written confirmation to be provided to it within ten business days of an oral notification." If you do not provide the written confirmation when properly requested, the bank is no longer required to provisionally credit your account (§ 1693f(c)). Best practice: notify orally same-day for the 2-business-day liability cap, then follow up in writing within 10 business days.

Can the bank close my account because I disputed a charge?

Generally, no — both Reg E and Reg Z forbid retaliation for good-faith dispute exercise. But the protections are imperfect. A bank can close any account for any non-discriminatory reason, and proving retaliatory motive is hard. If you suspect retaliation, the CFPB consumer-complaint portal accepts these complaints and the bank's response is a public record.

What if the unauthorized charge is a free trial that converted to a paid subscription?

This is one of the highest-volume disputes by both count and dollar value. The merchant will typically argue that the conversion was disclosed at signup and authorized in advance. Your strongest path is to (a) preserve the original signup terms and any cancellation confirmation, (b) cite the merchant's failure to deliver pre-conversion notice if your state requires it (California, New York, Illinois, Vermont, and Washington all have stronger state subscription laws than federal law as of May 2026), and (c) file as a FCBA "claims and defenses" dispute under § 1666i, which gives you the merchant-contract defenses even if the original signup was technically authorized.

Is there ever a case where debit gives me a better dispute outcome than credit?

Yes, one. The 10-business-day investigation deadline for debit (§ 1693f(a)) is genuinely faster than the 30/90-day FCBA deadlines. If you need the money back in your account fast and the underlying dispute is clean (an obvious unauthorized transfer, properly reported within 2 business days), the debit timeline can outrun the credit timeline. But the universe of "clean" disputes is small, and the downside risk of debit (your money is gone while you wait) almost always outweighs the speed advantage. Use credit as the default and reserve debit for transactions where reversibility doesn't matter.

The Bottom Line

The federal statute book treats your debit card and your credit card as different financial instruments with different consumer-protection regimes, even though your wallet treats them as interchangeable. The deltas matter most when something goes wrong: $450 of additional liability exposure on debit, no statutory "claims and defenses" backstop, no automatic provisional-credit duty on the credit side, sharply different investigation timelines. The single best protection you can give yourself is to swipe credit by default and check your debit statements within 60 days. Both statutes assume you are paying attention. Both statutes are unforgiving when you aren't.

Set a recurring reminder for your statement-close dates. Read the line items. If anything looks wrong, file the dispute the day you notice — within 2 business days for debit, within 60 days for both — and put it in writing. The deadlines are short, the law is on your side, and the burden of proof is on the bank. The only thing the law cannot give you is the calendar reminder to actually look.

This article is informational, not legal advice. Statutory citations verified verbatim against 15 U.S.C. §§ 1643, 1666, 1666i, 1693f, and 1693g as published by the Legal Information Institute at Cornell Law School on May 13, 2026. Card-network reason codes referenced from Visa Core Rules and Mastercard Chargeback Guide public documentation. For dispute-specific advice in complex situations, consult an attorney admitted in your state or file a complaint with the Consumer Financial Protection Bureau.