How Much of a USD 2,000 Stolen-Card Bill Is Carrie Responsible For? Legal Liability, Timing, and the 60-Day Rule Under US Law

Carrie is generally responsible for USD 0 of the USD 2,000 in fraudulent charges, because the Fair Credit Billing Act caps her liability at USD 50 for unauthorized use of a credit card, and that USD 50 applies only if the creditor asks for it under specific conditions. Her delay of several days in noticing the theft does not by itself raise that cap. What could cost her money is missing the 60-day written-dispute window after the statement showing the charges was sent. The exact answer depends on whether the charges hit a credit card or a debit card, whether she reported by phone or in writing, and how many days actually elapsed.

The liability mechanism: why the cap is USD 50 and not USD 2,000

US federal law splits fraud liability by payment instrument, not by how careless the cardholder was. For credit cards, the Truth in Lending Act as amended by the Fair Credit Billing Act limits a consumer's liability for unauthorized use to USD 50. The Federal Reserve's Regulation Z implements that rule at 12 CFR 1026.12(b), and it conditions the USD 50 on the creditor having provided a way to report loss or theft. If the card issuer never gave Carrie a means to notify it, the regulation caps her liability at USD 0.

Two features of this mechanism matter more than most summaries admit. First, "unauthorized use" has a legal definition: use by someone without actual, implied, or apparent authority, from which the cardholder receives no benefit. A thief who grabs Carrie's card from a gym locker fits cleanly. A family member with permission to borrow the card does not, which is why household fraud disputes often fail. Second, the USD 50 is a ceiling, not a fee. Many major issuers voluntarily waive it, so the practical answer for most cardholders is zero.

The Fair Credit Billing Act also supplies the second half of Carrie's protection: the right to dispute billing errors, including unauthorized charges, if she sends written notice within 60 days after the issuer sent the first statement containing the charge. That written-dispute right is separate from the USD 50 cap, and conflating the two causes most of the confusion in thin explainers.

A phone call protects the USD 50 cap but may not preserve the 60-day dispute right. The regulation and FTC guidance tie the dispute window to written notice, so a caller who never follows up in writing can lose leverage even though the cap still applies.

Under 15 USC 1643 and Regulation Z, Carrie's maximum exposure on a credit card is USD 50 even if she never reports at all, provided the issuer met its disclosure duties. Loss of the card, rather than theft, historically carried a higher USD 500 ceiling for cards like ATM cards, but the credit-card line is what governs Carrie's USD 2,000 scenario.

Quantified context: the numbers behind the USD 2,000

The USD 2,000 figure matters less than the instrument. On a credit card, Carrie's statutory ceiling is USD 50, so the issuer absorbs at least USD 1,950. On a debit card, the answer tilts by timing: reporting within 2 business days after learning of the loss caps liability at USD 50, and reporting within 60 days of the statement caps it at USD 500. Wait beyond 60 days, and the Electronic Fund Transfer Act exposes the account to unlimited liability for transfers after the 60-day window. That gap, USD 50 versus potentially USD 2,000 or more, is the single biggest variable in the question.

The 60-day clock itself is precise. Under Regulation Z, the issuer must give the consumer 60 days after it sent the statement on which the problem or error appeared. Counting starts at sending, not receipt. A statement mailed on March 1 gives Carrie until roughly April 30; if charges posted across two cycles, she gets a fresh 60 days for each statement that contains a disputed item. For debit cards, the EFTA clock runs 60 days from the statement's transmittal, not 60 days from the theft.

FTC survey work has estimated that about 9 percent of adults reported a fraudulent bank or credit card transaction in a prior year, and the median fraudulent transaction on a newly opened account was USD 400. Carrie's USD 2,000 is large enough to exceed typical single-transaction fraud, which often reflects a stolen physical card used in several rapid purchases. A stolen card used for days usually produces a cluster of charges, not one USD 2,000 purchase, so Carrie should expect the issuer's fraud team to examine each authorization.

For context, the FTC's Consumer Sentinel Data Book has reported credit card fraud losses in the hundreds of millions of dollars annually, with identity theft complaints in the hundreds of thousands per year. The point of these figures is scale, not precision for Carrie. A high charge count actually helps her: multiple suspicious authorizations on the same account are easy for issuers to flag and reverse.

Edge cases: when the ceiling moves

Age changes the rule. A cardholder under 18 generally cannot be held liable for unauthorized use, which shifts the answer to USD 0 regardless of the USD 50 cap. A consumer in bankruptcy has the debt, if any, treated under the estate.

Negligence is not the same as authorization. Leaving a card in a locker or a car may violate the cardholder agreement, but Regulation Z's USD 50 cap does not scale with carelessness. What can change the outcome is giving someone apparent authority, such as a roommate who routinely uses the card for groceries, or writing a PIN on the card. In those cases the issuer may argue the use was authorized, and the entire USD 2,000 could survive.

Fraud limited to the number, without the physical card, usually produces stronger protections because the card never left Carrie's possession and the issuer's systems can verify that the chip was not present.

Debit cards are the harshest edge case. Because the money leaves the account immediately, the consumer is arguing over reimbursement of funds already gone, not a credit balance. That is why debit fraud disputes take longer and why the 2-business-day and 60-day thresholds are unforgiving.

Business cards sit outside the consumer-protection rules. Corporate and small-business cards are generally governed by the cardholder agreement, not Regulation Z's consumer liability limits, so the issuer may hold the business liable for the full USD 2,000. The account's owner, not the person carrying the card, is usually the party on the hook.

Misconceptions: delay, police reports, and "I should have noticed"

The most common myth is that failing to notice the theft for several days raises Carrie's liability. It does not, on a credit card. The USD 50 cap survives delay under 15 USC 1643, and the 60-day clock runs from the statement date, not the theft date, so a week of not noticing loses nothing.

The second myth is that a police report is required to get the charges reversed. Some issuers ask for one, and an identity-theft report through IdentityTheft.gov can help, but there is no federal requirement that a cardholder file one before invoking the USD 50 cap.

The third myth is that calling the issuer is sufficient. The USD 50 cap is protected by a call, and the call is the urgent step, but the 60-day dispute right generally requires written notice that identifies the account, the amount, and the date. A call without a follow-up writing can leave the dispute deadline unprotected.

A related misconception treats the USD 50 as money Carrie owes. It is a legal maximum. If the issuer waives it, and many do, the answer is USD 0 and no payment is due.

Practical actions for Carrie

Steps specific to the USD 2,000 figure:

Call the number on the back of the card, not a number from an email, and ask for the fraud department by name. State clearly that the card was physically stolen and that charges were not authorized; ask for the dispute reference number. Follow the call with written notice, sent by a method that proves delivery, listing each charge, the amount, and the date. Stop using the compromised card and account immediately; destroyed cards prevent further charges and protect the USD 50 position. Ask whether the issuer will waive the USD 50 entirely, and whether it will remove the charges from the credit report if they were reported.

A useful timeline for the mechanism:

The same timeline applies to debit cards, but with two differences. First, the 2-business-day threshold for reporting rather than the 60-day window governs the USD 50 versus USD 500 outcome. Second, the funds have already left the account, so a provisional credit is often necessary while the issuer investigates.

Threshold reconciliation is worth stating plainly. On credit cards, delay in reporting does not change the USD 50 ceiling, because the statute does not include a diligence test. The 60-day clock is a separate deadline for the written billing dispute, and missing it reduces Carrie's tools, not her statutory cap. On debit cards, delay does change the ceiling, through the 2-business-day and 60-day thresholds. The answer that applies to Carrie's USD 2,000 depends on which floor the transaction came from.

Limitations and bottom line

The analysis above assumes a consumer credit card issued by a US bank, a card stolen physically, and charges made without Carrie's knowledge or consent. It does not cover business accounts, gift cards, prepaid cards outside Regulation Z's credit provisions, or cases where the issuer can show apparent authority. If Carrie gave anyone the card number or access code, the "unauthorized" label becomes contestable, and the USD 50 cap may give way.

The USD 2,000 figure is also a starting number, not a final one. Issuers can and do reverse unauthorized charges above the legal minimum, and some go further as a goodwill matter. Carrie's practical task is to preserve her rights, not to calculate the floor.

This article is general educational information, not legal or financial advice, and it does not promise any outcome or reimbursement. Cardholder agreements, state law, and the facts of a specific account can change the analysis, so readers should consult a qualified attorney or the card issuer's fraud department for advice about their own case.