Once Two Business Days Close, a $700 Loss Caps at $500 or $150

The Official Interpretations to Regulation E run one fact pattern twice, and the second run contradicts the figure most debit card holders think they know. A card is stolen on a Monday. The consumer learns of the theft that same day and reports it on Friday. Two unauthorized transfers clear in between, one of $100 and one of $600 — $700 in total, reported four days late, both times. In the first version the consumer's liability is $500. In the second it is $150. The only thing that moved is which of the two transfers came first.

Comment 6(b)(2)-1 of the CFPB's Official Interpretations (Supplement I) to Part 1005 does that arithmetic itself: “In this example, assume a $100 unauthorized transfer was made on Tuesday and a $600 unauthorized transfer on Thursday. Because the consumer is liable for the amount of the loss that occurs within the first two business days (but no more than $50), plus the amount of the unauthorized transfers that occurs after the first two business days and before the consumer gives notice, the consumer's total liability is $500 ($50 of the $100 transfer plus $450 of the $600 transfer, in this example). But if $600 was taken on Tuesday and $100 on Thursday, the consumer's maximum liability would be $150 ($50 of the $600 plus $100).”

A $350 swing on an identical loss, an identical card, and an identical four-day delay. The swing is not a rounding artifact. It is what happens when one paragraph uses $50 as a ceiling on everything in its first branch and as the first of two addends in its second, and when the word “day” is counted by two different systems three sentences apart.

The Fifty Dollars Is Two Different Numbers

Start with the branch that produces the familiar figure. Per the eCFR text of 12 CFR 1005.6, paragraph (b)(1) reads: “If the consumer notifies the financial institution within two business days after learning of the loss or theft of the access device, the consumer's liability shall not exceed the lesser of $50 or the amount of unauthorized transfers that occur before notice to the financial institution.” Here $50 is a ceiling on everything inside this branch, with nothing added to it — though (b)(3) can stack this same $50 on top of a 60-day failure, as the next section shows. The credit card figure in 12 CFR 1026.12(b)(1)(ii) keeps the single job.

The next branch reuses the same $50 in a different job. 12 CFR 1005.6(b)(2): “If the consumer fails to notify the financial institution within two business days after learning of the loss or theft of the access device, the consumer's liability shall not exceed the lesser of $500 or the sum of: (i) $50 or the amount of unauthorized transfers that occur within the two business days, whichever is less; and (ii) The amount of unauthorized transfers that occur after the close of two business days and before notice to the institution, provided the institution establishes that these transfers would not have occurred had the consumer notified the institution within that two-day period.”

Read the two designators side by side. In (b)(1) the $50 caps the total. In (b)(2)(i) the same $50 caps one window only — the losses that land inside the first two business days — and (b)(2)(ii) is then stacked on top of it. The total ceiling in the second branch is $500, not $50. The official summary in comment 6(b)-1 keeps the three figures but drops the structure: “There are three possible tiers of consumer liability for unauthorized EFTs depending on the situation. A consumer may be liable for: (1) up to $50; (2) up to $500; or (3) an unlimited amount depending on when the unauthorized EFT occurs. More than one tier may apply to a given situation because each corresponds to a different (sometimes overlapping) time period or set of conditions.” The last sentence is the warning: the tiers overlap, so a reader who treats “up to $50” as a single allowance has already lost the arithmetic.

Paragraph (b) Carries Six Branches, Not Three

Comment 6(b)-1 names three tiers. The regulation it interprets is longer. Section 1005.6 of Part 1005 has two lettered paragraphs, (a) and (b), and no paragraph (c); paragraph (b) runs through six numbered branches, and the last three rewrite the first three. Paragraph (a) gates them: liability requires that the institution gave the disclosures required by § 1005.7(b)(1), (2), and (3), and, where an access device was used, that the device was an accepted one issued to a consumer the institution can identify.

12 CFR 1005.6(b)(3) supplies the third tier and a second clock: “A consumer must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution's transmittal of the statement to avoid liability for subsequent transfers. If the consumer fails to do so, the consumer's liability shall not exceed the amount of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution, and that the institution establishes would not have occurred had the consumer notified the institution within the 60-day period. When an access device is involved in the unauthorized transfer, the consumer may be liable for other amounts set forth in paragraphs (b)(1) or (b)(2) of this section, as applicable.” That closing sentence is the stacking rule: the 60-day tier sits on top of the $50 or $500 tier rather than replacing it. Comment 6(b)(3)-2 shows how far the long clock reaches without a card at all: a $200 debit by other means draws no liability if reported within 60 days of transmittal, while a $400 transfer on the 61st day, reported on the 62nd, can be charged in full.

Then 12 CFR 1005.6(b)(4) moves every deadline named above it: “If the consumer's delay in notifying the financial institution was due to extenuating circumstances, the institution shall extend the times specified above to a reasonable period.” 12 CFR 1005.6(b)(5) decides when the clocks stop, including constructively — notice “may be considered constructively given when the institution becomes aware of circumstances leading to the reasonable belief that an unauthorized transfer to or from the consumer's account has been or may be made.” And 12 CFR 1005.6(b)(6) can delete the arithmetic entirely: “If state law or an agreement between the consumer and the financial institution imposes less liability than is provided by this section, the consumer's liability shall not exceed the amount imposed under the state law or agreement.” Three tiers set the numbers; three more branches decide which numbers the account actually faces.

Where the Same $700 Splits

Run the commentary's two orderings through (b)(2) in order. In ordering A, the $100 transfer falls inside the first two business days and the $600 falls after their close. Branch (i) returns the lesser of $50 and $100, so $50. Branch (ii) returns $600. The sum is $650, and the lesser of $500 and $650 is $500 — the tier cap binds, and the commentary splits the same result as $50 of the $100 plus $450 of the $600.

In ordering B, the $600 moves to Tuesday and the $100 to Thursday. Branch (i) returns the lesser of $50 and $600, still $50. Branch (ii) returns $100. The sum is $150, the $500 ceiling does not bind, and the consumer's liability is $150 — $350 below ordering A. The large transfer has not shrunk; it has simply moved to the side of the two-business-day line where (b)(2)(i) caps it at $50.

Two Business Days and Sixty Days Count Days Differently

The line that decides the split is itself measured by two rules at once. The eCFR text of 12 CFR 1005.2 defines a business day in paragraph (d) — not (b), which defines an account — as “any day on which the offices of the consumer's financial institution are open to the public for carrying on substantially all business functions.” That definition selects which days qualify. It does not set when the period ends. Comment 6(b)(1)-3 does, and it detaches the ending from the institution's hours: “The two business day period does not include the day the consumer learns of the loss or theft or any day that is not a business day. The rule is calculated based on two 24-hour periods, without regard to the financial institution's business hours or the time of day that the consumer learns of the loss or theft. For example, a consumer learns of the loss or theft at 6 p.m. on Friday. Assuming that Saturday is a business day and Sunday is not, the two business day period begins on Saturday and expires at 11:59 p.m. on Monday, not at the end of the financial institution's business day on Monday.”

Measure the commentary's own example against a clock. From 6 p.m. Friday to 11:59 p.m. Monday is 77 hours and 59 minutes. A consumer who learns of a theft one minute before midnight on a Monday, with Tuesday and Wednesday both open for business, sees the same two business days expire at 11:59 p.m. Wednesday — exactly 48 hours. The identical phrase delivers 48 hours to one account holder and 77 hours and 59 minutes to another, because the day of learning is discarded and closed days are skipped. The same hazard runs through Regulation Z, which defines business day twice.

Three sentences later in the same paragraph, the long clock abandons that machinery. Paragraph (b)(3) says 60 days from transmittal of the statement, and comment 6(b)(3)-1 reads those as calendar days: the consumer “must notify the financial institution within 60 calendar days after the periodic statement was sent; otherwise, the consumer faces unlimited liability for all unauthorized transfers made after the 60-day period.” No day is discarded, no closure is skipped, and the start is the institution's act of transmittal rather than the consumer's knowledge. One paragraph, two counting systems: the short clock runs on the institution's open-for-business calendar, the long clock on the wall calendar. Both of them allocate the loss. The error-resolution timetable sits in § 1005.11 — see provisional credit under Regulation E — and neither § 1005.11 nor § 1005.18 was reopened today.

Read Without a Sum, the Statute Still Reaches Both Figures

The regulation writes an addition problem. The statute behind it does not. Govinfo's copy of 15 U.S.C. 1693g sets a flat ceiling first, in subsection (a): “In no event, however, shall a consumer's liability for an unauthorized transfer exceed the lesser of— (1) $50; or (2) the amount of money or value of property or services obtained in such unauthorized electronic fund transfer prior to the time the financial institution is notified of, or otherwise becomes aware of, circumstances which lead to the reasonable belief that an unauthorized electronic fund transfer involving the consumer's account has been or may be effected.”

Then it carves an exception out of that ceiling, and the carve-out has a ceiling of its own: “In addition, reimbursement need not be made to the consumer for losses which the financial institution establishes would not have occurred but for the failure of the consumer to report any loss or theft of a card or other means of access within two business days after the consumer learns of the loss or theft (or in extenuating circumstances such as extended travel or hospitalization, within a longer period which is reasonable under the circumstances), but the consumer's liability under this subsection in any such case may not exceed a total of $500, or the amount of unauthorized electronic fund transfers which occur following the close of two business days (or such longer period) after the consumer learns of the loss or theft but prior to notice to the financial institution under this subsection, whichever is less.”

Two words carry the result. The carve-out is limited to transfers occurring “following the close of two business days” — so in ordering A it reaches the $600 and in ordering B only the $100. And the cap is on “a total of $500,” which is why ordering A stops at $500 rather than adding $50 to a $500 carve-out and producing $550. Subsection (a) itself writes no sum and gives no rule for combining its flat ceiling with the carve-out; read as a ceiling plus an exception it lands on $150 in ordering B, which is the regulation's figure, but that combination is a reading of the statute rather than a line in it.

Numbers to Re-check

Six entries change meaning with the designator they sit under; two of the six are conditions rather than figures.

The $50: a ceiling on total liability under (b)(1), but under (b)(2)(i) a ceiling on one window only, with (b)(2)(ii) added to it and $500 as the total. The ordering: which transfers landed before the close of the two business days, because the commentary's $700 produces $500 one way and $150 the other. The expiry: 11:59 p.m. on the second qualifying day under comment 6(b)(1)-3, which is 48 hours in one example and 77 hours and 59 minutes in another, and not the institution's closing time. The 60 days: calendar days from the institution's transmittal of the statement under comment 6(b)(3)-1, not days from the transaction and not days from receipt. The institution's burden: both (b)(2)(ii) and (b)(3) condition the later amounts on the institution establishing that those transfers would not have occurred had notice come in time. And the conditions in paragraph (a), which gate every figure above.

Where This Doesn't Apply

None of this arithmetic governs a credit card. The CFPB's text of 12 CFR 1026.12 sets one figure in (b)(1)(ii): “The liability of a cardholder for unauthorized use of a credit card shall not exceed the lesser of $50 or the amount of money, property, labor, or services obtained by the unauthorized use before notification to the card issuer under paragraph (b)(3) of this section.” There is no two-business-day branch, no $500 tier and no 60-day cliff in that paragraph; the three items in 1026.12(b)(2) are conditions of liability, not tiers.

The first two tiers also drop out when no access device was used. Comment 6(b)(3)-2: “The first two tiers of liability do not apply to unauthorized transfers from a consumer's account made without an access device. If, however, the consumer fails to report such unauthorized transfers within 60 calendar days of the financial institution's transmittal of the periodic statement, the consumer may be liable for any transfers occurring after the close of the 60 days and before notice is given to the institution.” The $200 and $400 figures above are that branch at work: one clock, no tiers under it.

Three further exits sit inside paragraph (b) itself. Extenuating circumstances such as extended travel or hospitalization extend the periods under (b)(4) and comment 6(b)(4)-1. A state statute or an account agreement that imposes less liability displaces the section's figures under (b)(6); § 1005.12 was not reopened today and no state statute is named here. And if the paragraph (a) conditions were not met, the tiers do not start.

Two limits on this reading, by way of what was not reopened today. The loss allocation in § 1005.6 is not the error-resolution timetable in § 1005.11, and because § 1005.11 was not read today, none of its deadlines are stated above. § 1005.18 was not read either, so nothing above is extended to prepaid or payroll card accounts.