A fraudulent charge shows up on your statement. You did not make it. Someone tells you zero liability means you owe nothing. That is mostly true, and the word "mostly" is doing real work. Zero liability is a promise from a card network, not a federal law. It has conditions. Here is how it fits with the federal rules, and where it stops.

What zero liability means and where it comes from

Zero liability is a voluntary policy. Visa's version says cardholders will not be held responsible for unauthorized charges made with their account or account information. The policy says you do not need to enroll or sign up for it. Coverage generally follows the type of card and the type of transaction.

Federal law is a separate thing. It sets a floor of protection for lost, stolen, or misused credit, ATM, and debit cards. A card agreement can give you more than that floor. It cannot give you less. Because the network policy is private, the network can change it. The federal floor stays where it is.

How federal limits depend on timing and card type

The federal rules care about when you report. According to the CFPB, if you report a lost or stolen credit card before anyone uses it, you cannot be held responsible for unauthorized charges. If the card is still in your wallet but a thief uses your account number, you generally have no liability for that use.

If charges happen before you report a missing credit card, the most you can owe is $50. Many card agreements say you owe nothing. That is the credit card picture. Debit and ATM cards sit under a different rule, with tiers based on how fast you report. The excerpt of that rule available for this piece showed only a table of contents, so no dollar tiers are confirmed here. Read the regulation text yourself before relying on a summary.

Short version of the federal pattern:

  1. Report before the card is used, and you generally owe nothing for unauthorized charges.
  2. Lose only the account number, and you generally have no liability for unauthorized use.
  3. Report after misuse on a credit card, and the ceiling is $50.
A cardholder in a bright bank lobby circles an unfamiliar charge on a printed statement with a pen, weighing what their card protection actually covers.
A cardholder reviewing a printed statement and circling an unfamiliar charge with a pen

What the policy covers and what it leaves out

Visa says its policy covers most of its credit and debit cards. It does not apply to certain commercial card transactions, to anonymous prepaid cards, or to transactions not processed by Visa. So the logo on the card does not settle the question. The specific charge matters too.

Another gap is the authorized user. A financial institution may exclude a transaction made by a person you allowed to act on the account. It may also exclude one that goes past the authority you gave. A relative with access to your card can land in that zone even when you never meant the charge to happen.

Some questions the public sources do not answer. They do not say whether ATM cash withdrawals are covered. They do not say how the policy treats other card brands. Ask your issuer before you assume.

How replacement funds work and why they can be reversed

Under the policy, the issuer is expected to replace funds taken in an unauthorized transaction within five business days of notification. The disputed charge generally has to be posted to the account first.

Those funds are provisional. The issuer may withhold, delay, limit, or rescind them. The listed reasons are gross negligence or fraud, a delay in reporting, an investigation of the claim, and the standing and history of the account. The sources do not define gross negligence or fraud here. Nobody can tell you where that line sits. The one lever you control is speed.

Also unanswered: whether interest can build on a disputed charge while the issuer investigates. Ask.

Practical steps, in order

Do these first, and do them in this order.

  1. Report the charge to your financial institution right away. Phone, email, online banking, or the app all work. Write down the date and time.
  2. Follow up in writing. The FTC advises a letter with your account number, the date and time you noticed the card missing, and when you first reported it. Send it to the address listed for billing disputes on credit cards or errors on debit cards.
  3. Read your cardholder agreement. The CFPB's Credit Card Agreement Database can help you find it.
  4. Keep reading statements. Early catches support faster reports.

Federal sources are worth a look: the CFPB explanation of lost or stolen card charges and the FTC page on lost or stolen cards.

Questions to ask your issuer and mistakes to avoid

Ask these plainly:

  • Is my card a commercial or anonymous prepaid card, and does the policy apply?
  • Was this transaction processed through the network?
  • How fast must I report before a delay could reduce replacement funds?
  • Under what conditions can funds be withheld, delayed, limited, or taken back?

Red flags in your own habits are short. Leaning on the network policy alone is one. It is voluntary, and the federal limits are the more durable floor. Waiting to report is another, since protection depends on timing. Skipping the written follow-up is the third. None of these is dramatic. Each one quietly weakens a protection you would otherwise have.

This is general education, not advice for your situation. Your card agreement and your issuer have the final word on your account.