Credit vs Debit for Online Shopping: the Reg Z Billing-Error Window in Practice

The Reg Z billing-error claim, in practice

Reg Z (12 CFR 1026.13(a)) defines a billing error broadly. It includes computational errors, transactions the consumer did not make or authorise, transactions reflecting goods or services not accepted by the consumer, transactions reflecting goods or services not delivered to the consumer as agreed, and reflections of an incorrect amount. This is wider than the narrow fraud-only protection most consumers assume credit cards provide.

In an online-shopping context, the billing-error claim is the consumer's recourse when: a package never arrives, a package arrives damaged and the merchant refuses replacement, a merchant ships the wrong item and refuses return, a subscription continues to charge after a documented cancellation, a free-trial converts to paid after the consumer claims to have cancelled within the trial window, or a digital service was advertised with features the delivered product lacks. None of these is straightforward fraud. None of them would be covered by Reg E on a debit card, because the EFT itself was technically correct: the bank moved the money the consumer authorised at checkout.

The consumer must notify the issuer in writing within 60 days of the date the statement containing the disputed item was sent (12 CFR 1026.13(b)(1)). The notice has to identify the consumer, the account, the dollar amount, and the reason for the dispute. Most issuers accept disputes via secure message in the mobile app or online banking, which preserves the written-notice requirement. A phone call alone does not preserve the legal claim, although most issuers will open an investigation by phone as a courtesy.

Once the issuer receives the dispute, Reg Z (12 CFR 1026.13(c)) requires acknowledgement within 30 days and resolution within 90 days (the issuer must complete its investigation in two billing cycles, not to exceed 90 days). During the investigation, the consumer is not required to pay the disputed amount, no late fees can be assessed on the disputed amount, and the issuer cannot report the disputed amount as delinquent to the credit bureaus.

The Reg E narrowness

Reg E (12 CFR 1005.11) covers a much narrower category: errors in electronic fund transfers. An error is defined in 1005.11(a)(1) as an unauthorised EFT, an incorrect EFT, an EFT to or from the wrong consumer account, a computational or bookkeeping error by the financial institution, the consumer's receipt of an incorrect amount of money from an ATM, an EFT not reflected on a periodic statement, or a request for additional information about an EFT.

Notice what is not on that list: goods or services not delivered. The EFT was authorised at checkout. The bank moved the money correctly. The merchant simply failed to deliver. Under Reg E, this is not an EFT error. The consumer's legal recourse is to sue the merchant directly. The bank's only obligation is to point the consumer at the dispute department of the network (Visa or Mastercard) and to extend any voluntary chargeback right the network has set as a courtesy. Many large debit issuers do extend voluntary chargeback rights, but the rights are discretionary, the investigation is not on a statutory clock, and the consumer's checking account is debited until and unless the provisional credit posts.

Virtual card numbers and merchant tokens

A virtual card number is a single-use or merchant-locked replacement for the underlying card number. The actual card number stays in the wallet. The virtual number gets sent to the merchant. If the merchant database is breached, the leaked number is useless: it has either already been used (single-use) or is locked to one merchant (merchant-locked). The underlying account is never exposed.

Capital One Eno, Citi Virtual Account Numbers, and American Express disposable virtual numbers are the major issuer-side implementations. Privacy.com is a third-party service that funds virtual numbers from a linked bank account or debit card. Apple Pay and Google Pay use a tokenisation framework that performs a similar function in card-present and in-app contexts: the merchant receives a device-specific token, not the underlying card number.

Virtual numbers are available on both credit and debit cards from many issuers. The protection profile differs: a virtual debit number still draws on a checking account if used fraudulently, and the cardholder still depends on Reg E's narrow EFT-error claim for recovery. A virtual credit number combines the merchant-isolation benefit with the underlying Reg Z dispute right and the no-cash-impact recovery. For the highest-risk online merchants (unfamiliar retailers, free trials, foreign sites), a virtual credit number is the strongest combination of protections available.

Common questions

Related on this site