I Fought the Law and I Won

Can you answer this basic consumer question?

According to federal law, if you’re the victim of credit card fraud, your losses are limited to:
A. $50
B. $50, provided you notify the card issuer within 60 days
C. Neither of the above

If you don’t know the answer, don’t feel bad. The government seems to be having trouble with it as well.

The story you’re about to read reminded me of an old song – I Fought the Law and the Law Won. To get you in the mood for what follows, let’s go back to a time when rock bands wore ties and go-go dancers wore guns: Watch Bobby Fuller sing, try to keep from laughing, then meet me on the other side.

Like that music? Then here’s a treat – for the rest of this post, every paragraph heading will take you to another song.

The (almost) Never Ending Story

While editing a recent story called 5 Reasons Not to Worry About Credit Card Hacking, I noted it included a line that said, “As reported by the FTC (Federal Trade Commission), federal law limits credit card losses to $50, provided the fraud is reported to the card issuer within 60 days.”

When I read that, I thought it was wrong. I’ve been doing this a long time, and I was sure there was no such 60-day requirement – consumer losses are limited to $50, period. When I asked the writer about it, he said he’d found that on the FTC website. And sure enough, this page of the FTC site says…

You cannot be held liable for more than $50 for fraudulent purchases made with your credit card, as long as you let the credit card company know within 60 days of when the credit card statement with the fraudulent charges was sent to you.

Confused, I searched more and found on this page of the FTC site…

“Your maximum liability under federal law for unauthorized use of your credit card is $50.“

Obviously, both of these statements can’t be right. And this is important – because millions of Americans carry credit cards and need to know the limits of their liability in the case of fraud. So I figured I’d better contact the FTC and get a clarification.

And that’s where my fight with the law begins.

Dazed and Confused

On April 17, I called someone I’ve dealt with in the past – we’ll call him Dick – who works in FTC media relations. At first, Dick explained the FTC isn’t in charge of credit cards – that’s now the responsibility of the newly formed Consumer Financial Protection Bureau. Dick suggested I call them.

I agreed to do that, but insisted this is still an FTC issue because they’re presenting conflicting information to the public. He agreed and asked me to email him links to those conflicting pages. Here’s my email…

Hi again Dick,

If you could get me clarification re the following, I’d be much obliged… I’ll also follow your advice and contact the Consumer Financial Protection Bureau…

On this page: “You cannot be held liable for more than $50 for fraudulent purchases made with your credit card, as long as you let the credit card company know within 60 days of when the credit card statement with the fraudulent charges was sent to you.”

On this page: “Your maximum liability under federal law for unauthorized use of your credit card is $50.”

Thanks!
Stacy

About 90 minutes later, Dick sent this email back…

From our staff:

Hope this helps clarify things:

Credit Card Loss or Fraudulent Charges (Fair Credit Billing Act – FCBA). Your maximum liability under federal law for unauthorized use of your credit card is $50. If you report the loss before your credit cards are used, the FCBA says the card issuer cannot hold you responsible for any unauthorized charges. If a thief uses your cards before you report them missing, the most you will owe for unauthorized charges is $50 per card. Also, if the loss involves your credit card number, but not the card itself, you have no liability for unauthorized use.

There you have it: Losses are limited to $50. End of story? Not quite.

I had also followed Dick’s advice and emailed the media relations department of the Consumer Financial Protection Bureau (CFPB). A CFPB media relations person (we’ll call her Jane) replied…

Hi Stacy,
I’ve checked and the law requires that a consumer notify the card issuer within 60 days. It would be best to check with the FTC about the inconsistency you found on their website.

Caught in the Crossfire

So now we have two federal agencies, both charged with protecting the public, unable to agree on something fairly basic and definitely critical. Here’s my response to both Dick and Jane…

Well, now we’ve got a problem, Jane.

My press contact at the FTC, Dick (CCed above) responded to a similar request with a different answer.

I now find myself in a unique situation: two government agencies reporting two different things. This is a fundamental question, and an important one: It affects everyone with a credit card.

Jane, since you checked the law, perhaps you could forward the pertinent section of it so Dick and I can see the actual wording supporting this position. I’ve been a consumer reporter for 22 years and it has always been my belief that consumer losses due to credit card fraud were limited by federal statute to $50. I could have been wrong all this time, or the law may have changed. But whatever the case, I need a definitive answer I can pass along to the public.

I sent that email just before 7 p.m. on April 17. When I’d heard nothing back by 1 p.m. the next day, I called Jane. She explained that “because she’s not a lawyer,” she had referred my problem up the chain. She assured me that she’d be in touch as soon as she knew something.

On April 19th, I got an email from Jane. Here it is…

Hi Stacy,

Here are links to information about the Fair Credit Bill Act and Regulation Z.

The Fair Credit Billing Act is codified as part of TILA at 15 USC 1666 & 1666a.

The 60 day notice requirement for billing errors is in Reg Z at 12 CFR 1026.13(b)(1).
Here is the link to the whole of Reg Z. There is an index at the beginning with links to all sections of Reg Z. It takes a while to load, but it does work.

Hope this helps!
Jane

I should have let it go at that, but because of my long experience and Dick’s reply, I still wasn’t convinced. So I did what I should have done in the first place: I used the links Jane sent and read the applicable portions of the law and Reg Z myself. Rather than explain what I found, I’ll simply end this post with the email I sent to both Jane and Dick the next day…

Good morning, Jane,
Thank you for supplying the statute and Reg Z. Although the sections you reference don’t answer the question I asked, I was able to quickly find the answer.

The question I originally asked: It has always been my belief that consumer losses due to credit card fraud were limited by federal statute to $50. The FTC website agrees in one place, but in another mentions a 60 day notification requirement. Can you please clarify?

Your response: the law requires that a consumer notify the card issuer within 60 days.

This is incorrect. The liability limit for unauthorized use of a credit card is $50 – there is no 60 day requirement.

The confusion arose because you and the person who posted that information on the FTC site – as well as one of the writers here – were operating under the assumption that the pertinent statute sections were those pertaining to billing disputes – where the 60 day rule does apply. There are other sections of both the statute and Reg Z, however, that pertain to unauthorized use. They limit liability to $50 with no notification requirement.

I’ve cut and pasted the relevant sections below.

-EXPCITE-
TITLE 15 – COMMERCE AND TRADE
CHAPTER 41 – CONSUMER CREDIT PROTECTION
SUBCHAPTER I – CONSUMER CREDIT COST DISCLOSURE
Part B – Credit Transactions
-HEAD-
Sec. 1643. Liability of holder of credit card
-STATUTE-
(a) Limits on liability
(1) A cardholder shall be liable for the unauthorized use of a credit card only if –
(A) the card is an accepted credit card;
(B) the liability is not in excess of $50;

§ 1026.12 Special credit card provisions.
(ii) Limitation on amount. The liability of a cardholder for unauthorized use of a credit card shall not exceed the lesser of $50 or the amount of money, property, labor, or services obtained by the unauthorized use before notification to the card issuer under paragraph (b)(3) of this section.

Thanks for your help, Jane. Now we all know the correct answer and can move forward.

Have a great weekend,
Stacy

It’s Not Right, But It’s OK

Sorry about all the detail, but I wanted you to see the whole thing. Are there lessons here? You bet…

First and foremost, we learned that if our credit cards are ripped off, we’re not liable for more than $50, whether we report it to the issuer or not. But we also learned that if we want to dispute a charge, we have to do so within 60 days.

Another major lesson: Even the government agencies responsible for enforcing consumer protection laws can get it wrong. They can post incorrect information on their websites and leave it there. (I notified the FTC on April 17 they were incorrectly using the 60-day requirement on their site. As I write this on April 24, it’s still there.)

And finally, spokespeople for these agencies can do something thoroughly human: Dig in their heels and insist they’re right when they’re not.