You gave someone your debit card PIN. Then you figured out they were not who they said they were. That sinking feeling is normal. What you do in the next few hours matters more than how you feel about it.
Why timing matters most
Debit card purchases, ATM withdrawals, and some automatic payments are electronic fund transfers. Federal rules under Regulation E cover them on consumer checking and savings accounts. Those rules set how much you can be held responsible for when a transaction was not made or allowed by you. The CFPB explains the basics in its guidance on getting money back after an unauthorized transaction.
The tiers run on a clock. Report a lost or stolen card within two business days of discovering the loss, and your liability is capped at the lesser of the unauthorized amount or $50. Report after that, and you could be responsible for up to $500. If a statement shows an unauthorized withdrawal and you wait more than 60 days to tell your bank, you could be liable for the full amount of transactions made after the 60 days and before you report.
Scammers do not wait for business days. Start the clock yourself, today, by calling.
What the rules do not clearly cover
Here is the awkward part. Those liability tiers are written for lost or stolen cards. You did not lose your card. You handed over a PIN, voluntarily, to someone who lied to you.
The CFPB material this article relies on does not say how the tiers apply to that situation. It does not say whether a bank will treat the transactions as unauthorized when you were tricked into sharing a PIN. So do not assume the $50 cap applies. Do not assume it does not, either. The outcome may depend on the facts and on the bank's own review.
The full text of the liability rule, 12 CFR 1005.6, is on the CFPB site. You can read the rule itself and its official comments. The CFPB's Regulation E FAQ is another place to look. You can also ask your bank to explain its position in writing, so you have a record of what it said.
Steps to take right away
Order matters. Do these first.
- Call your bank or credit union. Use the number on the back of your card or on its official website. Never use a number the caller or a text gave you.
- Describe each transaction you did not make. Say plainly that you shared your PIN with a scammer.
- Ask when your investigation window begins. Write down the date, the time, the representative's name, and any reference number.
- Ask whether the card can be blocked and the PIN changed.
Once you report, the institution generally has ten business days to investigate, according to the CFPB. If it determines an error occurred, it must correct the error within one business day of that finding. It then has three business days to report its findings to you. Keep your own record of these dates in a notebook or a note on your phone. Do not rely on remembering them.
Reporting and protecting yourself further
Go through every statement. Look at ATM withdrawals, small test charges, and automatic payments. Note the date each statement was sent, because that starts the 60-day window for unauthorized withdrawals shown on it.
The FTC has a page on what to do if you were scammed and another on lost or stolen cards. Check these pages for current steps. The OCC also keeps a page on card fraud.
One question stays open. If you authorized a payment after being deceived, it is unclear whether it can be reversed. Ask your bank directly. Keep the scam messages, call logs, and screenshots. If the bank's answer is unsatisfying, that paper trail helps if you file a complaint with the CFPB or your state regulator.
Red flags worth remembering
- A caller who asks for your PIN. Banks generally warn customers never to share it.
- Pressure to act now, before you can hang up and call back.
- A request to keep the call secret from your bank or family.
This article is general education, not personal financial or legal advice. Your bank can tell you how the rules apply to your account.
