Fraudulent Charges: Credit, Debit, and Criminal-Law Distinctions

This article is provided for educational and informational purposes only. It does not constitute legal, financial, or tax advice, and no attorney-client relationship is formed by reading it. Laws, regulations, official guidance, and related information vary by jurisdiction, change frequently, and may have changed or become outdated since publication. Always verify current information with authoritative sources and consult a qualified professional about your specific circumstances. The author and publisher assume no liability for actions taken based on this information.

A fraudulent charge is commonly understood as a payment-card transaction made through deception or without the account holder’s authority. That everyday phrase can describe several different legal problems. It may involve unauthorized credit-card use, an unauthorized debit-card transfer, identity theft, or a merchant billing dispute. It does not, by itself, identify the crime that prosecutors could charge or establish that a particular person committed fraud.

This distinction matters because the rules governing a consumer’s account are not the same as the rules governing a criminal case. Federal consumer law creates procedures for disputing certain transactions and limits liability in defined circumstances. Criminal liability, by contrast, depends on the elements of a specific federal or state offense and the evidence of intent and conduct. A broader introduction to those offense concepts appears in our guide to fraud.

Unauthorized use, billing errors, and merchant disputes are different

For credit cards, federal law defines “unauthorized use” as use by someone without actual, implied, or apparent authority when the cardholder receives no benefit. That definition can make permission important: a transaction is not necessarily unauthorized merely because the cardholder later regrets it or disagrees with the person who made it.

The federal billing-error process is broader than stolen-card use. It covers qualifying errors such as an extension of credit that was not made as shown, a charge for property or services the consumer did not accept or that were not delivered as agreed, certain computation errors, and a creditor’s failure to reflect a payment or credit. A disagreement over quality alone is not automatically the same as an unauthorized transaction.

Debit cards operate under the federal Electronic Fund Transfer Act framework and Regulation E. An “unauthorized electronic fund transfer” generally means a transfer initiated by someone other than the consumer without actual authority and from which the consumer receives no benefit, but the definition excludes some transfers by people furnished with the access device and certain fraudulent transfers initiated by the consumer.

Credit-card liability and the billing-error timetable

Under federal law, a cardholder can be liable for unauthorized credit-card use only if specified conditions are satisfied. Among them, the card must be accepted, the issuer must provide an adequate means to identify the user, and the unauthorized use must occur before the cardholder notifies the issuer of possible unauthorized use. Even when those conditions are met, liability may not exceed $50.

The issuer has the burden of proving that the use was authorized or that the conditions for imposing liability were met. This statutory ceiling is distinct from any more protective promise an issuer may make in its account agreement.

A billing-error notice under Regulation Z generally must be written, identify the consumer and account, indicate the believed error and explain why, and reach the creditor within 60 days after the first periodic statement reflecting the alleged error was sent. The creditor generally must acknowledge a qualifying notice within 30 days unless it resolves the matter sooner.

The creditor must ordinarily investigate and either correct the error or explain why it believes the statement was correct within two complete billing cycles, but no later than 90 days after receiving the notice. During that process, the regulation restricts collection of the disputed amount and related finance charges, although the undisputed portion remains payable under the account terms.

Debit-card timing can change the loss allocation

Regulation E uses different timing rules for unauthorized electronic fund transfers. When an access device is lost or stolen, notice within two business days after the consumer learns of the loss or theft generally limits liability to the lesser of $50 or the amount of unauthorized transfers before notice.

If notice comes after those two business days, the potential ceiling can rise to $500 under the regulation’s formula. Separate rules apply to unauthorized transfers appearing on a periodic statement: a failure to notify the institution within 60 days can expose the consumer to losses from later transfers that the institution shows could have been prevented by timely notice.

These are statutory allocation rules, not a finding that the account holder committed wrongdoing. They also do not determine whether a merchant, intermediary, or suspected user is criminally responsible.

How the federal error-resolution process works

For an electronic-fund-transfer error, a financial institution generally must investigate promptly after receiving a qualifying notice and determine whether an error occurred within 10 business days. It may require written confirmation within 10 business days when the consumer first gives oral notice.

If the institution cannot finish within the initial period, Regulation E generally permits a longer investigation—ordinarily up to 45 days—if the institution provisionally credits the account within the prescribed time and gives the consumer full use of that amount while it investigates. Longer 20-business-day and 90-day periods apply in specified circumstances, including certain new accounts, point-of-sale debit transactions, and transfers initiated outside a state.

After the investigation, the institution must report the result within three business days. If it finds an error, it must correct the error within the regulation’s timetable; if it finds no error, it must give a written explanation and disclose that the consumer may request the documents on which the decision relied.

Why an account decision is not a criminal verdict

A bank’s decision to reverse, provisionally credit, or reinstate a transaction answers an account-dispute question under consumer law and the account agreement. It does not adjudicate the elements of theft, identity theft, payment-card fraud, wire fraud, or another criminal offense.

The available criminal classification may turn on the conduct, the means of payment, the amount, the alleged actor’s intent, and the jurisdiction with authority over the event. Federal and state offenses can overlap, but a national consumer-protection rule does not prove that every state uses the same offense name, grading system, or punishment. Related classifications are discussed in the overview of white-collar crime.

Reading a disputed transaction accurately

The useful first question is therefore not simply whether a charge looks fraudulent. The legal framework turns on what kind of account was used, whether the transaction was authorized, whether the consumer received a benefit, whether the issue is nonreceipt or another billing error, and when notice reached the institution.

Records such as statements, transaction dates, communications, and the institution’s written findings can affect how the dispute is evaluated. Their significance is fact-dependent, and consumer-liability rules do not substitute for the separate proof required in a criminal proceeding. For a closer discussion of how a single unauthorized transaction may be described, see fraudulent charge.

Sources

• Office of the Comptroller of the Currency: Credit Card and Debit Card Fraud
• 12 C.F.R. § 1026.13 — Billing Error Resolution
• 15 U.S.C. § 1643 — Liability of Holder of Credit Card
• 12 C.F.R. § 1026.12 — Special Credit Card Provisions
• 12 C.F.R. § 1005.6 — Consumer Liability for Unauthorized Transfers
• 12 C.F.R. § 1005.11 — Procedures for Resolving Errors
• 18 U.S.C. § 1029 — Fraud and Related Activity in Connection with Access Devices
• 12 C.F.R. § 1005.2 — Definitions