A Reg E liability calculation answers one question: once a bank has found that transfers were unauthorized, how much of the loss can it charge the customer? The answer depends only on how fast he reported. Report a lost or stolen card, PIN or code within two business days of learning of it, and his liability is capped at $50. Report later, and it can rise to $500. Fail to report transfers shown on a statement within 60 days of that statement, and he can owe the transfers that follow, without limit, if the bank shows a timely report would have stopped them. The calculator below does the arithmetic. The point for investigators is in the title: lateness changes the tier, not whether the transfer was authorized. Botminds' First-Party Fraud Detection, software for investigators deciding likely false Reg E claims, treats reporting time inside the rules as never a reason for a denial.
Reg E liability calculator
How is consumer liability calculated under Reg E?
By sorting the unauthorized transfers by when they happened, relative to two dates: when the customer learned his card or code was lost or stolen, and when the bank sent the statement that first showed an unauthorized transfer. The extent of the customer's liability, the commentary says, "is determined solely by the consumer's promptness in reporting the loss or theft of an access device." Nothing else enters: not his care with the card, not his history, not the bank's suspicion.
The regulation calls the result three tiers, and the commentary is careful that they are not alternatives: "More than one tier may apply to a given situation because each corresponds to a different (sometimes overlapping) time period or set of conditions." The calculator above adds the tiers in the order the commentary does.
The three tiers and the two clocks
$50
cap when the customer reports within two business days of learning of the loss or theft
$500
cap when he reports later, if the bank shows the later losses were avoidable
No cap
on transfers after 60 days from the statement, if the bank shows a timely report would have stopped them
60days
from the statement, not from the transaction, to report what it shows
What is the $50 and $500 rule? The three tiers in the rule's words
The $50 tier applies when the customer reports in time: he owes $50 or the amount taken before he gave notice, whichever is less. The $500 tier applies when he does not: his liability "shall not exceed the lesser of $500 or the sum of" up to $50 of what was taken in the first two business days and the transfers after that and before notice, "provided the institution establishes that these transfers would not have occurred had the consumer notified the institution within that two-day period" (12 CFR 1005.6(b)(1) and (2)).
The tiers, the conditions, and what the bank must show
| Tier | When it applies | Most the customer can owe | What the bank must establish |
|---|---|---|---|
| 1 | Card, PIN or code lost or stolen; reported within two business days of learning of it | $50, or the transfers before notice if less | That the 1005.6(a) conditions were met |
| 2 | Lost or stolen; reported after two business days | $500: up to $50 of the first two days’ transfers plus the later ones before notice | That the later transfers would not have occurred with a timely report |
| 3 | Unauthorized transfers shown on a statement not reported within 60 days of it | The transfers after the 60 days and before notice, with no cap | That those transfers would not have occurred with a report inside the 60 days |
| No device | Transfers made without a lost or stolen card or code, such as with an account number | Nothing for transfers inside the 60-day window; tier 3 still applies after it | As tier 3 |
Worked example one: two transfers and a report on Friday
The commentary's own example shows why the order of transfers matters as much as their size. A card is stolen on Monday and the customer learns of it the same day. He reports on Friday, so he missed the two-business-day deadline, which ran to midnight Wednesday. A $100 transfer was made on Tuesday and a $600 transfer on Thursday.
His liability is "$500 ($50 of the $100 transfer plus $450 of the $600 transfer, in this example)": $50 from inside the two days, and the Thursday transfer up to the $500 cap. Reverse the amounts, $600 on Tuesday and $100 on Thursday, and the same commentary puts his maximum at $150: $50 of the $600, plus the $100. Enter either case in the calculator with "No" for a timely report and the later transfer in the second box.
Worked example two: when the 60-day statement window closes
Federal Reserve examiners published a fuller example in 2025. A consumer loses his card on January 1 and notices the same day. On January 2, $400 of unauthorized transactions are made; on January 6, $600. The statement showing them is sent on February 5. On April 10, more than 60 days later, $800 is taken. He reports the lost card on April 30. In their arithmetic, his "total liability of $1,300" is $50 of the $400, $450 of the $600 and the full $800.
The Federal Reserve's example on one line: where each dollar falls
- Loss learned, then to the statementJan 1 to Feb 5
- 60 days from the statementto Apr 6
- After the windowto Apr 30
- $50 of $400 (Jan 2) + $450 of $600 (Jan 6)$500, the tier 2 cap
- $800 (Apr 10)$800
The example exists because examiners keep finding the opposite reading. Some institutions, they write, "mistakenly believe" that the 60-day notice window also cuts off the liability limits; in fact, while a consumer has unlimited liability for transactions after the 60-day period, "the liability limits under §1005.6 still apply for transactions that occurred prior to the 61st day". A customer who reports on day 85 still gets the tier 1 or tier 2 protection for everything before day 61.
What the bank has to establish before it charges the customer
The bank carries every burden in the calculation. Under the EFTA it must establish that the conditions of liability were met (15 U.S.C. 1693g); under 1005.6(a) the customer can be held liable at all only if the bank gave the required disclosures and, where a card or code was used, it was an accepted access device with a means of identifying the customer. For the amounts above $50, the bank must also establish that a timely report would have stopped the later transfers.
That last condition is not a formality. A transfer that would have gone through regardless, because the bank could not have blocked it in time even with a prompt report, stays with the bank. The calculator's two tick boxes are where that judgment goes; untick them and the customer owes nothing for that window.
How are the two business days counted?
From the day after the customer learns of the loss, counting only business days, as two full 24-hour periods. The commentary: "The two business day period does not include the day the consumer learns of the loss or theft or any day that is not a business day. The rule is calculated based on two 24-hour periods, without regard to the financial institution's business hours or the time of day that the consumer learns of the loss or theft." Its example: a customer who learns at 6 p.m. on Friday, at a bank open Saturday but not Sunday, has until 11:59 p.m. on Monday.
Two details trip desks up. A statement showing an unauthorized transfer "may be a factor" in whether the customer knew of a loss, but "cannot be deemed to represent conclusive evidence that the consumer had such knowledge". And notice counts when the customer takes reasonable steps to give it, even if he uses a number or address other than the one the bank specified.
Does late reporting mean the claim is denied?
No. Late reporting decides how much of an unauthorized loss the customer bears; it says nothing about whether the transfer was unauthorized. A bank that denies a claim because the customer waited has answered the wrong question. Even a report made after the 60-day window keeps the tier 1 or tier 2 protection for transfers before day 61, and Regulation E's 60 days run from the statement: the CFPB has warned that network rules requiring notice "within 60 days of the date of the transaction" do not change a bank's obligations.
The sample bank behind this series makes the point concrete. Its policy lists "reporting time within the rule" among the reasons that may never carry a denial, and in one month its fairness review struck that reason six times before a person saw the proposals. Its monthly review also found one denial, of $164.00 for a fintech partner's customer, that had rested on reporting time; without it the evidence was moderate, and the claim was reopened for payment. Every claim in the fictional sample carries its Reg E clock on screen, so the investigator sees the deadline that does matter.
The clock that matters: the bank's, not the customer's
What does not change the number
Negligence, agreements and suspicion. The commentary rules out carelessness as a basis for more liability (our guide to Reg E denial reasons quotes it), and adds that "no agreement between the consumer and an institution may impose greater liability on the consumer for an unauthorized transfer than the limits provided in Regulation E." The rule runs one way only: where state law or the account agreement imposes less liability, the lower figure applies (1005.6(b)(6)).
Before applying a liability tier to a claim
- Has the bank found the transfers unauthorized?
Liability applies only to unauthorized transfers. If the customer made them, there is no error and no tier.
- Were the 1005.6(a) conditions met?
Disclosures given, an accepted access device, a means of identifying the customer. If not, he owes nothing.
- When did he learn of the loss, and when did he report?
Count two business days from the day after he learned, as two 24-hour periods.
- When was the statement sent?
The 60 days run from transmittal, not from the transaction.
- Any extenuating circumstances?
Extended travel or hospitalisation extends the windows to a reasonable period.
- Can the bank show the later losses were avoidable?
Without that, the transfers after the deadlines stay with the bank.
- Does state law or the account agreement set a lower limit?
If so, the lower limit applies.
Where liability meets a first-party claim
A first-party finding and a liability tier answer different questions, and a well-run desk never lets one stand in for the other. If the investigation shows the customer made or authorized the transfer, there is no unauthorized transfer, and the tiers never apply. If it cannot show that, the transfer is treated as unauthorized and the tiers decide only how much of it the customer bears. Using a late report to tip an uncertain claim into a denial is how a liability rule becomes a denial reason, which is what examiners cite.
The family case is where this bites hardest: a relative who used a card the customer gave him is not an unauthorized user until the customer revokes his authority, so the date of that notice matters more than any tier. That case is worked through in when a family member took the money.
Questions people ask
When is consumer liability unlimited under Reg E?
Only for unauthorized transfers made after 60 days from the bank's transmittal of the statement that first showed one, and before the customer reports, and only if the bank establishes that a report within the 60 days would have stopped them. Transfers before day 61 keep the $50 or $500 limits.
What is the maximum liability under Regulation E?
For a lost or stolen card or code reported within two business days, $50. Reported later, $500, counting transfers inside the 60-day statement window. On top of either, any transfers after that window that the bank shows were avoidable, which have no cap.
Does negligence change a customer's liability?
No. Writing a PIN on the card or keeping it in a wallet does not raise liability above the regulation's limits. Giving a card and PIN to someone else is a different matter: that person's transfers are not unauthorized until the customer revokes their authority.
Does the customer have to report within 60 days of the transaction?
No. Regulation E's notice period runs 60 days from when the bank sends the statement showing the transfer, and the CFPB has said that network rules counting from the transaction date do not reduce a bank's obligations.
Can the bank deduct $50 from a provisional credit?
Yes, within limits. Under 12 CFR 1005.11(c)(2)(i), if the bank has a reasonable basis for believing an unauthorized transfer occurred and has met the 1005.6(a) conditions, it may withhold a maximum of $50 from the amount it credits provisionally.