Identity Theft Debt, You’re NOT Responsible for Half—Here’s What Federal Law Actually Says
The Truth About Identity Theft Debt Responsibility
Identity theft victims are NOT responsible for paying back “half” of fraudulent debt. This is one of the most dangerous misconceptions circulating online.
Here’s the truth: Federal law caps your liability at $50 for credit card fraud under the Fair Credit Billing Act (FCBA) and $50-$500 for debit card fraud under the Electronic Funds Transfer Act (EFTA)—depending on when you report it.
The confusion comes from people misinterpreting these liability “caps” as a “50% rule.” In reality, you could have $10,000 in fraudulent charges and owe just $50—or nothing at all if you reported immediately.
In December 2024, the CFPB issued an advance notice of proposed rulemaking to address identity theft and coerced debt under Regulation V, with potential new protections expected by May 2026.
Why This Matters to You
If you’re receiving debt collection notices for charges you didn’t make, understanding these federal protections could save you thousands of dollars.
This affects you if you’ve discovered unauthorized charges on your credit or debit cards, received collection notices for accounts you didn’t open, or are a victim of a recent data breach like the AT&T or Panera incidents that exposed millions of customer records.
Many identity theft victims panic when they see fraudulent debt totals reaching $5,000, $15,000, or more. Banks and debt collectors sometimes pressure victims to “settle” for thousands—but federal law strictly limits what you actually owe.
What You Came to Know: Your Actual Liability Under Federal Law
The FCBA $50 Cap for Credit Cards
Under the Fair Credit Billing Act (FCBA), your liability for unauthorized credit card charges is capped at $50 maximum per card—regardless of how much the thief charged.
If someone steals your credit card and racks up $20,000 in purchases, you owe $50. If you report the loss before any fraudulent charges occur, you owe $0.
The key: Report to your card issuer within 60 days of receiving your statement showing unauthorized charges.
The EFTA Caps for Debit Cards: Timing Is Critical
Debit cards and electronic transfers have different rules under the Electronic Funds Transfer Act (EFTA). Your liability depends on how quickly you report:
- $0 liability: Report before any unauthorized transactions occur
- $50 cap: Report within 2 business days of discovering the loss
- $500 cap: Report between 2-60 days after discovery
- Unlimited liability: Report more than 60 days after your statement showing unauthorized transfers
Bottom line: The 60-day deadline is critical for debit card fraud. Miss it, and you could be liable for all fraudulent charges.
When You Might Owe More
You could lose these protections if you:
- Failed to report fraud within the required timeframes (especially the 60-day EFTA deadline)
- Were negligent (shared your PIN, ignored fraud alerts, failed to secure your information)
- Actually authorized the transactions (then it’s not identity theft)
- Didn’t follow your bank’s dispute procedures
State Law May Protect You Even More
Some states provide zero liability for identity theft victims or stronger protections than federal law. California, New York, and several other states have enacted consumer protection statutes that eliminate victim liability entirely in certain circumstances.
Check your state attorney general’s website for state-specific identity theft protections.
What You Must Know: Common Mistakes That Cost People
The 60-Day Reporting Deadline Can Destroy Your Protection
Most sites won’t tell you this, but: missing the 60-day EFTA deadline for debit card fraud is the #1 mistake that leaves victims liable for thousands in fraudulent charges.
Mark your calendar. Set reminders. Check your bank statements immediately when they arrive.
Recent CFPB Action Changes the Game
The CFPB’s Spring 2025 regulatory agenda targets May 2026 for the next step in rulemaking on identity theft and coerced debt, potentially expanding the definition of “identity theft” to include coerced debt from domestic violence or elder abuse situations.
If finalized, these changes could provide even stronger protections for vulnerable populations starting in 2026.
What to Do Next
Step 1: Report Fraud Immediately
Call your bank’s fraud department today if you discovered unauthorized charges. Don’t wait.
File a report with the FTC at IdentityTheft.gov. This creates an official Identity Theft Report you’ll need to dispute fraudulent accounts.
Step 2: Dispute Charges in Writing
Send a written dispute letter to your bank within 60 days of your statement date. Keep copies of everything.
Include:
- Your Identity Theft Report from the FTC
- Police report (if available)
- List of fraudulent charges with dates and amounts
The CFPB (consumerfinance.gov) and FTC (identitytheft.gov) provide free sample dispute letters.
Step 3: Monitor Your Credit
Place fraud alerts with Equifax, Experian, and TransUnion. Consider a credit freeze to prevent new accounts from being opened in your name.
Get your free credit reports at AnnualCreditReport.com and check for unauthorized accounts.
For comprehensive identity theft protection services, review options like Is Discover Identity Theft Protection Worth It or explore if you qualify to Can You Get A New SSN After Identity Theft.
💡 Pro Tip
The 2-day reporting deadline under EFTA is business days—not calendar days. If you discover fraudulent debit card charges on Saturday, you have until close of business Tuesday to report and maintain the $50 liability cap. Don’t let weekends cost you hundreds or thousands in additional liability.
FAQs
What is the FCBA liability cap for credit card identity theft?
$50 maximum per card, regardless of total fraudulent charges. If you report before charges occur, you owe $0.
What’s the difference between FCBA and EFTA liability limits?
FCBA covers credit cards ($50 cap). EFTA covers debit cards and electronic transfers ($50-$500 depending on reporting timing, unlimited after 60 days).
What happens if I don’t report identity theft within 60 days?
For debit card fraud under EFTA, you could face unlimited liability for unauthorized transfers that occurred more than 60 days before you reported.
Am I liable for charges made AFTER I report fraud?
No. Once you report fraud timely to your bank, you have zero liability for charges made after your report.
Can debt collectors force me to pay fraudulent debt?
Not if you properly dispute it. Under the Fair Debt Collection Practices Act, collectors cannot pursue debts you’ve disputed as fraudulent with proper documentation. Learn more about debt collection rights at Texas Debt Collection Statute of Limitations.
Disclaimer: This article about identity theft victim debt responsibility and liability protections is provided for informational purposes only and does not constitute legal advice. Identity theft laws and liability protections vary significantly by state and are subject to change. AllAboutLawyer.com does not provide legal services, representation, or consultations. If you believe you are a victim of identity theft or have questions about your debt responsibility in your specific situation, consult a qualified attorney licensed in your state or contact the Federal Trade Commission (FTC), Consumer Financial Protection Bureau (CFPB), or your state attorney general’s office.
What to Do Next: If you’ve been affected by a data breach that led to identity theft, you may be entitled to compensation. Check recent settlements at AllAboutLawyer.com for ongoing class actions.
Stay informed, stay protected. — AllAboutLawyer.com
Last Updated: February 11, 2026 — We keep this current with the latest legal developments
This article provides general information about identity theft victim debt responsibility and liability protections. This is not legal advice. Consult a qualified attorney licensed in your state for specific legal guidance about your identity theft situation.
About the Author
Sarah Klein, JD, is a former consumer rights attorney who spent years helping clients with issues like unfair billing, product disputes, and debt collection practices. At All About Lawyer, she simplifies consumer protection laws so readers can defend their rights and resolve problems with confidence.
Read more about Sarah