Last reviewed October 8, 2026 by Jackson McMillan, Florida attorney
Short answer: A denial that calls a thief's purchases "authorized" because your card or PIN was used does not settle anything. Under Regulation E, transfers made with a stolen card, PIN, or phone are unauthorized, your share is capped at $50 or $500 depending on when you reported, and Chase must prove authorization. Request its file and have the denial reviewed.
Why did Chase call my skimmed or stolen debit card transactions "authorized"?
Because the transactions looked legitimate to the bank's systems. A skimmer captures the magnetic stripe and often the PIN; a stolen phone with a mobile wallet and saved passcode behaves like you. The denial reasons that follow, "chip read," "correct PIN entered," "device recognized," describe the tools the thief used, not your consent.
Skimming is common at gas pumps, standalone ATMs, and point-of-sale terminals. The cloned card then works at an ATM across the state or across the country, usually within days. A stolen or snatched phone is the other common path: the thief watches you type the passcode, takes the phone, and has your banking app, your mobile wallet, and your text messages for the one-time codes.
Under federal law, what you consented to is the only question that matters. A purchase made by someone who stole your card is not a purchase you made, no matter how cleanly the chip read. The rest of this page explains how Regulation E treats that fact, how much Chase can leave with you, and how to test the denial.
Who is Chase, and who regulates it?
Chase accounts are held at JPMorgan Chase Bank, N.A., a national bank with its main office in Columbus, Ohio, owned by JPMorgan Chase & Co. of New York. The Office of the Comptroller of the Currency (OCC) is its primary regulator, and with assets over $10 billion it is also supervised by the Consumer Financial Protection Bureau (CFPB).
Per the FDIC's Summary of Deposits for June 30, 2025, Chase had 419 Florida branches and about 8.8 percent of the deposits held in the state, third among Florida institutions. If you have a Chase personal checking or savings account, it is governed by the JPMorgan Chase "Deposit Account Agreement and Privacy Notice," and the version effective June 14, 2026 controls disputes today.
Reporting a stolen card or unauthorized charges to Chase
Chase's agreement describes the Regulation E error-resolution timeline: you have 60 days from the first statement showing the error to report it, the bank has 10 business days to investigate or to provisionally credit your account, and it may take up to 45 or 90 days to finish. The agreement also says Chase may require written confirmation within 10 business days of a phone report, so confirm every call in writing.
Zelle statements on Chase's pages
Chase's pages say Zelle payments cannot be reversed and that neither Zelle nor Chase provides purchase protection. The same pages say Chase reimburses unauthorized transfers made through its online or mobile services when they are reported promptly.
Arbitration, class waiver, and the two-year contract clause
The June 14, 2026 agreement contains a binding arbitration clause, a class action waiver, and a jury trial waiver. Either side can elect arbitration, and the opt-out is narrow: a customer may opt out only within 60 days of opening the account, and only by phone. If your account is older than 60 days, the opt-out has closed, and a dispute Chase elects to arbitrate will be decided by an arbitrator rather than by a Florida judge or jury.
The agreement also requires any lawsuit or arbitration against the bank to be filed within two years after the cause of action arises, unless the law provides a shorter period. For Electronic Fund Transfer Act claims the law does provide a shorter period, one year, so the one-year deadline is the one that governs your claim.
Public enforcement record
In December 2024 the CFPB sued JPMorgan Chase Bank, along with Bank of America, Wells Fargo, and Zelle's operator, over Zelle fraud handling. The CFPB voluntarily dismissed that lawsuit with prejudice in March 2025, so no court ever ruled on the allegations, and nothing in it should be read as a finding about Chase.
McMillan Law PLLC is not affiliated with Chase and does not represent it. Chase is named here because people search for help with its decisions.
Send the denial letter, the statements with the disputed transactions marked, and the dates you noticed and reported the theft, and I'll measure the bank's decision against Regulation E at no cost.
How much of a stolen debit card loss can Chase make me pay?
When a card, PIN, or phone is stolen, Regulation E caps your share by how quickly you reported after learning of the theft: $50 at most within 2 business days, up to $500 after that, and only for transfers the bank proves a quicker report would have prevented. Carelessness, including a PIN kept in your wallet, cannot raise those caps.
The Electronic Fund Transfer Act (EFTA) is the federal statute covering debit card purchases, ATM withdrawals, and transfers from a consumer's bank account, and Regulation E is the rule that carries it out. Both treat a transfer as unauthorized when a person other than you initiates it without actual authority and you receive no benefit (12 C.F.R. § 1005.2(m)). The regulation's commentary says a transfer by someone who got your access device through fraud or robbery is unauthorized (comment 2(m)-3), and a stolen card or phone is the plainest example.
| When you told Chase | The most you can be made to pay | Rule |
|---|---|---|
| Within 2 business days after learning the card or phone was lost or stolen | $50, or the amount taken before your report if that is less | 12 C.F.R. § 1005.6(b)(1) |
| More than 2 business days after learning of it | Up to $500: the first $50, plus transfers after day 2 that the bank proves a timely report would have stopped | § 1005.6(b)(2) |
| More than 60 days after the statement listing the theft was sent | Also transfers made after the 60 days and before your report, if the bank proves a timely report would have prevented them | § 1005.6(b)(3) |
Three points about the table. The 2-business-day clock starts when you learned the card or phone was gone, not when it was taken. The caps reach only later transfers that faster notice would have prevented; the first unauthorized transactions are protected regardless, with the one-year limit to sue as the outer edge. And extenuating circumstances such as a hospital stay or extended travel extend each period (§ 1005.6(b)(4)).
Negligence is off the table by rule: the commentary says a consumer's negligence cannot be the basis for increasing liability (comment 6(b)-2). A PIN written on the card sleeve or an unlocked phone may earn you a lecture from the bank; neither changes the caps. Nor can the account agreement raise your liability above what the regulation allows (§ 1005.6(b)(6)).
When the dispute reaches a courtroom or an arbitrator, the EFTA assigns the burden of proof to the bank: it must show the transfer was authorized, or that the conditions for consumer liability were met (15 U.S.C. § 1693g(b)). A chip read and a PIN match show that the card and PIN were used. They do not show who used them.
What must Chase do once I report the theft?
Once you report within 60 days after the statement was sent, Chase must investigate and decide within 10 business days, or provisionally credit your account and finish within 45 days, extended to 90 days for debit card purchases. It cannot require a police report or charge a fee, and must give written findings and the documents behind any denial.
Your report can be oral or written; it needs to identify you and your account and say why you think there is an error, with the date and amount of each transaction as far as you know them (12 C.F.R. § 1005.11(b)(1)). A federal court in North Florida held that an error notice has to identify the transactions, so list each ATM withdrawal and purchase separately. If you called first, send the written confirmation Chase may require within 10 business days; the bank may not stall the investigation while waiting for it, but it may withhold provisional credit if the letter never arrives.
Provisional credit is the temporary return of the disputed money, with interest where the account earns it. Chase must post it within 10 business days if it wants the longer period, tell you the amount and date, and let you use the funds (§ 1005.11(c)(2)). Point-of-sale debit purchases and transfers started outside the United States get 90 days instead of 45; ATM withdrawals do not (§ 1005.11(c)(3)). A new account, one whose first deposit came within 30 days before the transfer, gets 20 business days instead of 10.
The investigation has to be genuine. Because Chase has agreements with the card networks and merchants that process debit purchases, it cannot limit its review to its own records (§ 1005.11(c)(4)). The CFPB's Electronic Fund Transfers FAQs, still posted as of October 2026, say a bank may not require a police report, a notarized affidavit, a branch visit, or merchant contact as a condition of investigating, and the commentary bars any fee.
When the investigation ends, Chase has 3 business days to report the result. If it finds an error, it must correct it within 1 business day, including fees and interest. If it finds none, it must explain its findings in writing and tell you about your right to request the documents it relied on, then provide them promptly in a form you can understand (§ 1005.11(d)(1)). A reversal of provisional credit comes with its own duties: notice of the date and amount, and 5 business days of honoring your checks and preauthorized payments without overdraft fees (§ 1005.11(d)(2)).
Why do Chase debit card fraud claims get denied?
The denial reasons I see most often are the chip and PIN, a recognized device or location, a merchant's statement that the sale was valid, a report the bank calls late, or a missing written confirmation. Each has a specific answer under the regulation, and none of them relieves the bank of its burden to prove you authorized the transactions.
- "Chip and PIN were used, so the card was present and authorized." Skimmers capture both. A thief with the physical card has both too. Presence of the card proves nothing about the presence of the cardholder.
- "The transactions occurred near your home." A thief who stole your phone or wallet in Tampa spends the money in Tampa. Geography is a clue to investigate, not a conclusion.
- "The merchant confirmed the purchase." The merchant confirmed that it was paid. It has no way of knowing who handed over the card, and accepting its word is not an investigation of your claim.
- "Mobile wallet transactions require your passcode." A thief who watched you unlock the phone has the passcode, and the one-time codes arrive on the same stolen device.
- "The report came more than 60 days after the statement." Late reporting exposes only later transfers the bank can prove it would have prevented. It does not make the earlier ones yours.
- "The bank never received your written confirmation." That excuses, at most, the provisional credit; the investigation, the written explanation, and the document request still stand.
What are my rights against Chase as a Florida consumer?
In Florida the EFTA is the law that governs a denied debit card fraud claim. The state's deceptive practices statute does not reach banks, and Florida has no separate electronic transfer law. Florida federal courts have applied the EFTA's investigation and timing rules, and the statute allows suit in state or federal court, subject to Chase's arbitration clause.
My office is in Tampa, and I represent Chase customers with these claims throughout Florida; the review and nearly all of the work happen by phone, email, and video.
The Florida Deceptive and Unfair Trade Practices Act exempts banks, credit unions, and savings associations (Fla. Stat. § 501.212), so the usual state unfair-practices claim is not available against Chase. The EFTA's statutory damages and fee shifting are what make a claim over a few hundred or a few thousand dollars worth pursuing.
Florida decisions worth knowing: Monroe v. Grow Financial Federal Credit Union (M.D. Fla. 2022), where the court found a financial institution had not reasonably investigated a disputed debit or met its burden of proving authorization; Katz v. JPMorgan Chase (S.D. Fla. 2015), where the court held an error-resolution claim accrues when the bank missed its deadline, not when the charge posted; and Rallis v. First Gulf Bank (N.D. Fla. 2008), on the need to identify the disputed transactions in your notice.
A court will also ask whether you suffered a concrete injury; losing the use of money taken from your account, even temporarily, generally qualifies.
What is a denied Chase fraud claim worth?
A consumer whose bank violated the EFTA can recover actual damages, statutory damages of $100 to $1,000, and reasonable attorney's fees and costs. Actual damages start with the thief's withdrawals and purchases and can include overdraft and returned-item fees they caused. In defined circumstances the court can award up to three times your actual damages.
The statutory award does not depend on proving a dollar loss; the court sets it within the range by weighing how often and how seriously the bank fell short and whether the failure was intentional (15 U.S.C. § 1693m(a), (b)). The fee provision shifts the reasonable cost of a lawyer to the bank when the consumer wins.
Trebling is available in two situations: the bank failed to provisionally recredit the account within 10 business days and either did not investigate in good faith or had no reasonable basis to believe there was no error; or the bank knowingly and willfully concluded there was no error when that conclusion could not reasonably be drawn from the evidence (§ 1693f(e)). The multiplier works on your actual damages, not the statutory figure.
Chase can raise a bona fide error defense if it had reasonable procedures, and a court may award fees against a consumer who sues in bad faith, which is why I evaluate the facts before recommending a claim. You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign.
How long do I have after Chase denies my claim?
One year from the violation to sue under the EFTA. Where the violation is the bank's handling of your report, a Florida federal court has counted the year from the bank's missed deadline rather than from the theft. Chase's agreement mentions a two-year filing limit, but the EFTA's shorter one-year period is the deadline that controls these claims.
The statute sets the year (15 U.S.C. § 1693m(g)), and Katz applied it to a bank's error-resolution failure. Measure from the first disputed transaction and act well inside the year.
Shorter clocks run alongside it. Report any transaction still unreported within 60 days after the statement showing it was sent. If you only just discovered that the card or phone is gone, report within 2 business days to keep your share at $50 or less. And if the bank has already denied the claim, request the documents now so the response arrives with time left to act on it.
What to do today
- Report every unreported transaction to Chase by phone, then in a letter to the error-resolution address in your Deposit Account Agreement, listing each one by date, amount, and merchant or ATM location.
- Ask for the investigation file in writing, citing Regulation E and requesting each document Chase relied on to find the transactions authorized. Date your request and keep a copy.
- Lock down what the thief has: if your phone was taken, sign it out of your accounts, call your carrier, and change your Chase password and email password from another device.
- Build the timeline: when you last used the card or had the phone, when you noticed it missing, when you first called Chase, and when the denial arrived. These dates set your liability cap.
- Gather these documents: the denial letter; statements from the month before the first fraudulent transaction through today; the police report if you filed one (helpful, though not required); receipts or location evidence showing where you were when the charges posted; the claim number and a log of each call with names and dates; your written confirmation, if sent; and any merchant or ATM receipts the thief left behind.
- Send it to me. Request a free case review and attach the denial and your statements. I'll tell you which cap applies to you and whether Chase met its burden.
Sources: 15 U.S.C. §§ 1693a(12), 1693f(e), 1693g(b), 1693m(a), (b), (c), (f), (g); 12 C.F.R. §§ 1005.2(m), 1005.6(b)(1) to (6), 1005.11(b), (c)(1) to (4), (d)(1), (d)(2); Official Interpretations to Regulation E, comments 2(m)-3, 6(b)-2, 11(b)(1)-2, 11(c)-2, 11(c)-3, 11(c)(4)-5; CFPB, Electronic Fund Transfers FAQs (page last modified January 16, 2025); JPMorgan Chase, Deposit Account Agreement and Privacy Notice, effective June 14, 2026; FDIC Summary of Deposits, June 30, 2025; CFPB v. Early Warning Services, LLC, Bank of America, N.A., JPMorgan Chase Bank, N.A., and Wells Fargo Bank, N.A., D. Ariz. No. 2:24-cv-03652 (complaint filed December 20, 2024; dismissed with prejudice March 5, 2025); Katz v. JPMorgan Chase, 2015 WL 11251764 (S.D. Fla. Feb. 10, 2015); Monroe v. Grow Financial Federal Credit Union (M.D. Fla. 2022), 2022 WL 17417034 (Dec. 5, 2022); Rallis v. First Gulf Bank, 2008 WL 4724745 (N.D. Fla. Oct. 24, 2008); Fla. Stat. § 501.212. Last reviewed October 8, 2026.