A chargeback is the mechanism your card issuer uses to forcibly pull money back out of a merchant's bank account and return it to you. It is not a refund — a refund is the merchant choosing to give your money back; a chargeback is your bank taking it. And in the United States, the most you can legally be made to pay for someone else's unauthorised use of your credit card is $50, under Regulation Z §1026.12(b). In practice, most cardholders pay $0. Below: where that $50 comes from, the two very different kinds of dispute, the 60-day deadline that decides whether you have enforceable rights at all, the exact steps to file, and how the equivalent rules work in India.

What a chargeback actually is — and what it is not

Two separate systems are at work, and beginners constantly merge them. Your legal rights come from US law — the Truth in Lending Act and the Fair Credit Billing Act, written into Regulation Z. The chargeback is a private card-network rule: the rulebooks of Visa and Mastercard describing how money is clawed back between banks. The networks are referees, not regulators.

That distinction matters. Your issuer can lose a chargeback against a merchant under network rules and still owe you the money under Regulation Z. The chargeback is how the banks settle it between themselves; your rights sit underneath, independently.

Fraud dispute or merchant dispute? Get this right first

The single most important question your issuer will ask is: did you make this purchase?

A fraud dispute means you never authorised the charge. Regulation Z defines unauthorised use as use "by a person, other than the cardholder, who does not have actual, implied, or apparent authority for such use, and from which the cardholder receives no benefit." A merchant dispute means you did authorise it, but the goods never arrived, the service wasn't as agreed, or a cancelled subscription kept billing.

Different rulebooks, different first move. For fraud you call your issuer, never the merchant. For a merchant dispute, §1026.12(c) requires a good-faith attempt to resolve it with the merchant first, and adds two thresholds: the amount must exceed $50 and the transaction must have occurred in your home state or within 100 miles of your billing address. Those thresholds fall away in several cases — notably where the merchant is the issuer itself, controls or is controlled by the issuer, is a franchised dealer of the issuer, or obtained your order through the issuer's own mail solicitation.

What you are actually liable for: the $50 rule

Regulation Z §1026.12(b) caps your liability for unauthorised use of a credit card at "the lesser of $50 or the amount of money, property, labor, or services obtained by the unauthorized use before notification to the card issuer." That cap holds whether the thief spent $200 or $20,000.

The networks then layer their own promise on top. Visa's Zero Liability Policy states you "won't be held responsible for unauthorized charges made with your account or account information." Mastercard's applies where you "used reasonable care in protecting your card from loss or theft" and "promptly reported loss or theft to your financial institution." Both carve out certain commercial cards and unregistered prepaid or gift cards; Visa's also excludes transactions not processed over the Visa network. The honest summary: $50 is the legal ceiling; $0 is the realistic outcome — but $0 is a policy, not a statute, and policies have exclusions. Read your own cardholder agreement.

A worked example: $900 of charges you never made

A thief takes your card on a Monday. They spend $150 across Monday and Tuesday, then a further $750 between Wednesday and the following Monday. Total: $900. You spot it on day 8 and report it.

On a credit card: §1026.12(b) caps you at $50 despite the eight-day delay, and Zero Liability almost certainly takes it to $0. You were never out of pocket anyway — a credit card spends the bank's money, not yours.

On a debit card the arithmetic is brutally different. Regulation E §1005.6(b) sets tiers. Report within two business days of learning the card was lost or stolen and you owe the lesser of $50 or the amount taken — here $50, and the $750 never happens. Report later and your liability becomes (i) the lesser of $50 or what was taken in those first two business days, plus (ii) everything taken after that window and before you gave notice, capped at $500. Run it: (i) is min($50, $150) = $50; (ii) is $750; $50 + $750 = $800, capped at $500. You are out $500 of the $900 — and that cash already left your checking account.

One honest caveat. Those two-business-day tiers key off the moment you learn the card or credentials were lost or stolen. If your card never left your wallet and the fraud was purely card-not-present, the operative deadline is the third tier: report unauthorised transfers within 60 days of the statement showing them, or you can be liable without limit for what happens afterwards. Network Zero Liability covers most debit cards too and usually rescues people from these numbers. The tiers are what happens when it doesn't.

The 60-day clock that decides whether you have rights at all

Separately from liability, §1026.13 gives you a billing error resolution procedure — on a deadline. Your written billing error notice must reach the creditor "no later than 60 days after the creditor transmitted the first periodic statement that reflects the alleged billing error." Not 60 days from when you noticed. Sixty days from the statement.

Miss it and the $50 cap still applies, but you lose the enforceable procedure that forces your bank to act. Hit it and three things become mandatory: the issuer must acknowledge within 30 days; resolve within two complete billing cycles, and in no event later than 90 days; and while it is investigated you "need not pay (and the creditor may not try to collect) any portion of any required payment that the consumer believes is related to the disputed amount (including related finance or other charges)."

How to actually do it, step by step

1. Freeze the card in the app the moment you see a charge you don't recognise. This stops further losses.
2. Check it isn't you. A lot of "fraud" is an unfamiliar billing descriptor, a family member, or a foreign charge with a conversion markup — see how foreign transaction fees and dynamic currency conversion inflate a charge.
3. Call the issuer. The CFPB's advice is to "call the card company and let them know about the problem right away." This blocks the card and opens the case.
4. Then write. Calling alone does not start the statutory clock. Send a written billing error notice within 60 calendar days of the statement, to the billing-inquiries address in your card agreement — often not the payment address. Many issuers accept an online submission; the rule permits that if their billing rights statement says so. Include your account number, the amount and date of each disputed charge, and one sentence on why it is wrong.
5. Keep everything: dates, reference numbers, who you spoke to, screenshots. If the claim is declined, this is the file you appeal with.
6. Expect provisional credit, not final. Visa requires issuers to replace funds "within five business days of notification" — but explicitly on a provisional basis that "may be withheld, delayed, limited, or rescinded."

What happens behind the scenes: the chargeback chain

Your issuer raises a dispute under a specific network reason code. The network routes it to the merchant's bank, the acquirer, which debits the merchant and asks for evidence. The merchant can accept the loss or fight back with representment — delivery proof, an IP address, a signed receipt. If the issuer still disagrees it escalates to pre-arbitration and finally network arbitration, where the loser pays the fee.

The windows are tight. Under the Visa Core Rules dated 18 April 2026, the fraud dispute conditions carry a time limit of 120 calendar days from the transaction processing date. For merchandise or services not received, the issuer must wait 15 calendar days first, then file within 120 days of the processing date or of the last date you expected delivery. Those are the issuer's deadlines, not yours — which is why reporting late can leave your bank unable to recover from the merchant even when it still owes you.

What it costs you — and the catch

A successful dispute is usually free to you; the costs are subtler. Provisional credit can be reversed months later if the merchant's evidence wins, so don't spend it as though the case is closed. A fraud dispute normally means the card is cancelled and reissued, which breaks every autopay attached to it. And a chargeback is genuinely expensive for the merchant — the disputed amount plus a fee — which is why filing one against a legitimate business instead of asking for a refund ("friendly fraud") can get you banned by that merchant and, as a pattern, flagged by your issuer.

Common mistakes beginners make

• Calling but never writing. The call opens a case; only the written notice triggers the §1026.13 timeline.
• Waiting to see if it reverses itself. Pending charges that drop off are fine. Posted ones start a 60-day clock.
• Calling fraud what is really a merchant dispute. Saying "I never made this" about a purchase you did make is a false statement to your bank, and the merchant's receipt will surface it.
• Paying the disputed amount to protect your score. Keep paying the undisputed balance — a balance carried at card rates is expensive, as we showed in how credit card interest is actually calculated. But you are not required to pay the disputed portion while it is under investigation, and §1026.13(d)(2) bars the creditor from reporting that amount as delinquent because you didn't pay it — though it may note the account is in dispute, and may still report delinquency on undisputed amounts.
• Ignoring the follow-up. A disputed charge that later becomes a collection item can reach your credit file — and the inputs to that file are worth understanding, which we broke down in what actually moves your credit score.

How this works in India

India has no Fair Credit Billing Act, but the Reserve Bank of India's circular of 6 July 2017, "Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions," does much the same job — and is unusually clear about deadlines.

You have zero liability in two situations: where there is "contributory fraud/ negligence/ deficiency on the part of the bank," irrespective of whether you reported it; and in a third-party breach where the fault lies neither with the bank nor with you, provided you notify the bank within three working days of receiving the bank's communication about the transaction. Report a third-party breach four to seven working days late and your liability is the transaction value or the circular's Table 1 amount, whichever is lower: for credit cards, ₹10,000 where the card limit is up to ₹5 lakh and ₹25,000 where it is above ₹5 lakh (BSBD accounts ₹5,000; other savings and prepaid accounts ₹10,000). Beyond seven working days it is whatever your bank's board-approved policy says — worth reading before you need it. Working days are counted on your home branch's schedule, excluding the day the communication arrived.

Two provisions do most of the work for customers. On being notified, the bank must credit the amount back — a shadow reversal — "within 10 working days from the date of such notification by the customer," without waiting for any insurance settlement. And decisively: "the burden of proving customer liability in case of unauthorised electronic banking transactions shall lie on the bank." You do not have to prove you didn't do it.

If the bank stonewalls, the escalation route is the RBI Ombudsman. Per RBI's Ombudsman FAQs as of July 2026, you must complain to the bank first and may approach the Ombudsman if you have had no reply within 30 days (or the longer period specified by RBI, NPCI or card network guidelines), filing within 90 days of that timeline expiring or of the bank's last communication, whichever is later. Complaints go through RBI's online CMS portal.

FAQ

How long does a chargeback take? Your issuer must acknowledge a written billing error notice within 30 days and resolve it within two complete billing cycles — never more than 90 days. Many fraud claims settle far faster, often with provisional credit within days.

Am I liable if someone steals my credit card and spends $5,000? No more than $50 under Regulation Z §1026.12(b), and in practice $0 under Visa's and Mastercard's Zero Liability policies if you took reasonable care of the card and reported promptly. The cap holds however large the fraudulent spend was.

What is the difference between a chargeback and a refund? A refund is voluntary — the merchant returns your money. A chargeback is involuntary — your bank reverses the transaction through the card network and takes the money back from the merchant, who also pays a fee.

Can I dispute a charge after 60 days? You can ask, but after 60 days from the statement showing the charge you lose the enforceable §1026.13 procedure. The separate $50 cap on unauthorised use still applies — though your issuer's own network deadline, 120 days from the transaction processing date under the Visa rules, may have expired too.

Is a debit card as safe as a credit card for fraud? Legally, no. Credit card liability is capped at $50 regardless of timing; debit liability under Regulation E rises to $500 if you report late and becomes unlimited for transfers occurring more than 60 days after the statement that showed the problem. Debit fraud also takes real cash out of your account while it is investigated.

What if my bank rejects the dispute? Under §1026.13(f) the creditor must explain in writing why it believes your claim is incorrect and, if you request them, furnish copies of documentary evidence of your indebtedness. Ask for those, then resubmit with anything that rebuts them. In the US you can file a complaint with the CFPB; in India you can escalate to the RBI Ombudsman once the bank's 30-day window has passed.

Educational content only — not investment, tax, legal or insurance advice, and not a recommendation of any product. Rates, fees and rules change — always check current terms with your card issuer. [Sources: CFPB Regulation Z §1026.12, CFPB Regulation Z §1026.13, CFPB Regulation E §1005.6, CFPB: How do I dispute a charge, Visa Core Rules, 18 April 2026, Visa Zero Liability Policy, Mastercard Zero Liability, RBI circular, 6 July 2017, RBI Ombudsman FAQs, July 2026] Always do your own research.