Payroll Card Rules — In Plain Words

First, the companion question: can you be forced onto a payroll card?

That question is covered on its own page in this set, “Can My Employer Force Direct Deposit?” (https://plain-words-guides.pages.dev/can-my-employer-force-direct-deposit-in-plain-words/). That page covers the answer, the choices an employer has to offer, the short form and long form disclosures, and general fee examples. This page does not repeat that material. It starts where that page stops: with the rules that apply once wages are on a payroll card.

The law behind these rules, as the CFPB states it

The CFPB’s Bulletin 2013-10 explains two names. The Electronic Fund Transfer Act, short for EFTA, is the federal law. It generally covers the electronic transfer of funds to and from consumers’ accounts. Regulation E is the rule that implements the EFTA. Implements means it puts the law into detailed rules.

The bulletin states that employees whose wages are deposited onto a payroll card are entitled to the protections of the EFTA generally, and Regulation E’s provisions applicable to payroll cards specifically. It also states that the protections in Regulation E for consumers who receive wages on a payroll card mirror those available to consumers who make electronic fund transfers generally, with some exceptions.

The bulletin lists those protections. They include disclosures, access to account history, limited liability for unauthorized transfers, and error resolution rights. The rest of this page takes the last three of those in turn, in detail.

Your right to see your wage information: account history

Account history means the record of the transactions on your account — what came in, what went out, and what fees were charged. A periodic statement is the regular statement of that record.

The CFPB bulletin states the choice the issuer has. A payroll card issuer must either provide periodic statements as required by Regulation E generally, or alternatively must make available to the consumer:

• (1) the consumer’s account balance, by telephone;
• (2) an electronic history, such as through an Internet web site, of the consumer’s account transactions; and
• (3) upon the consumer’s oral or written request, promptly provide a written history of the consumer’s account transactions.

The bulletin states the history must set forth the same type of information required on periodic statements under Regulation E generally, including transaction information and the amount of any fees imposed during the period for electronic fund transfers, the right to make electronic fund transfers, or account maintenance.

How long the history must cover — the bulletin and the current rule, stated separately

The bulletin and the current text of Regulation E do not state the same coverage periods. This page prints both, attributed, and does not merge them.

As the CFPB Bulletin 2013-10 states it: the electronic history covers “at least 60 days preceding the date the consumer electronically accesses the account,” and the written history covers “at least 60 days prior to the request.”

As Regulation E, §1005.18(c)(1), states it now: a financial institution need not furnish periodic statements required by §1005.9(b) if it makes available to the consumer the account balance through a readily available telephone line; an electronic history of the consumer’s account transactions, such as through a Web site, that covers at least 12 months preceding the date the consumer electronically accesses the account; and a written history that is provided promptly in response to an oral or written request and that covers at least 24 months preceding the date the financial institution receives the consumer’s request.

Section 1005.18(c)(3) adds that the history provided under the alternative must include the information set forth in §1005.9(b).

What the history must show about fees

This section is about what must appear on the history itself. It is not a list of fee types. For the general fee examples and the short form and long form disclosures, see the companion page named above.

Section 1005.18(c)(4) states: a financial institution must disclose the amount of any fees assessed against the account, whether for electronic fund transfers or otherwise, on any periodic statement provided under §1005.9(b) and on any history of account transactions provided or made available by the financial institution.

Section 1005.18(c)(5) states: a financial institution must display a summary total of the amount of all fees assessed by the financial institution against the consumer’s prepaid account for the prior calendar month and for the calendar year to date on any periodic statement provided under §1005.9(b) and on any history of account transactions provided or made available by the financial institution.

The CFPB’s official comments on §1005.18(c) explain when a fee may be charged for a written history request that goes beyond what the rule requires. The comments give these examples of requests that exceed the requirements, and which therefore a financial institution may charge a fee for:

• a second request for written account transaction history made in a single calendar month — the comment’s example is a request on June 1 and another on June 15, where a fee may be charged for the June 15 request, while requests on June 1 and August 5 may not be charged for;
• a written history for transactions occurring more than 24 months before the request, if the institution keeps that much history and the consumer specifically requests that older period; and
• automatic mailings of written history on a monthly or other periodic basis, if the institution offers that option — but not for the written history requested under §1005.18(c)(1)(iii) itself.

The comments also state the matching limits: if an account has been open for fewer than 12 months, the electronic history need only go back to account opening, and if it has been open for fewer than 24 months, the written history need only go back to account opening. They also state that even if an account is closed or becomes inactive, the institution must continue to provide, on request, at least 24 months of written history preceding the request, until the account has been closed or inactive for 24 months or longer.

Fees at the start: the initial disclosures, in the bulletin’s words

The bulletin states one fee point that belongs on this rules page. Under Regulation E, payroll card holders are entitled to receive initial disclosures of any fees imposed by the financial institution for electronic fund transfers or for the right to make such transfers. The financial institution must also provide initial disclosures containing, among other things, details regarding limitations on liability and the types of electronic fund transfers they may make with the card.

The bulletin states that these disclosures must be made at account opening or before the first transfer occurs, and that Regulation E provides the disclosures be “clear and readily understandable, in writing, and in a form the consumer may keep.” It also notes that some state laws dictate that certain information be provided before an employee elects to receive wages via payroll card.

What counts as an error

Error resolution means the set of steps the financial institution must follow when you report that something on your account is wrong. Notice of error means your report to the institution that you believe an error exists.

Regulation E, §1005.11(a)(1), states that the term “error” means:

• (i) an unauthorized electronic fund transfer;
• (ii) an incorrect electronic fund transfer to or from the consumer’s account;
• (iii) the omission of an electronic fund transfer from a periodic statement;
• (iv) a computational or bookkeeping error made by the financial institution relating to an electronic fund transfer;
• (v) the consumer’s receipt of an incorrect amount of money from an electronic terminal;
• (vi) an electronic fund transfer not identified in accordance with §1005.9 or §1005.10(a); or
• (vii) the consumer’s request for documentation required by §1005.9 or §1005.10(a) or for additional information or clarification concerning an electronic fund transfer, including a request the consumer makes to determine whether an error exists under (i) through (vi).

Section 1005.11(a)(2) states what “error” does not include: a routine inquiry about the consumer’s account balance; a request for information for tax or other recordkeeping purposes; or a request for duplicate copies of documentation.

The official comments on §1005.11 add points that matter for a lost or stolen card. A financial institution is required to comply with the error resolution procedures when a consumer reports the loss or theft of an access device if the consumer also alleges possible unauthorized use as a consequence of the loss or theft. An access device is the card or other means used to reach the account. The comments also state that the institution must comply with the error resolution procedures when a consumer properly asserts an error, even if the account has been closed, and that a request for documentation or other information must be treated as an error unless it is clear the consumer is requesting a duplicate copy for tax or other record-keeping purposes.

How and when to report an error — the general rule, §1005.11

Section 1005.11(b)(1) states that a financial institution shall comply with the section for any oral or written notice of error from the consumer that:

• is received by the institution no later than 60 days after the institution sends the periodic statement or provides the passbook documentation required by §1005.9, on which the alleged error is first reflected;
• enables the institution to identify the consumer’s name and account number; and
• indicates why the consumer believes an error exists and includes, to the extent possible, the type, date, and amount of the error, except for requests described in paragraph (a)(1)(vii).

Section 1005.11(b)(2) states that a financial institution may require the consumer to give written confirmation of an error within 10 business days of an oral notice. An institution that requires written confirmation shall inform the consumer of the requirement and provide the address where confirmation must be sent when the consumer gives the oral notification.

Section 1005.11(b)(3) states a separate timing point for documentation requests: when a notice of error is based on documentation or clarification the consumer requested under paragraph (a)(1)(vii), the notice is timely if received no later than 60 days after the institution sends the information requested.

The official comments on §1005.11 state that the notice of error is effective even if it does not contain the consumer’s account number, so long as the institution is able to identify the account in question — for example, by a Social Security number or other unique means of identification. They also state that while an institution may request a written, signed statement relating to a notice of error, it may not delay initiating or completing an investigation pending receipt of the statement, and that a financial institution must begin its investigation promptly upon receipt of an oral notice and may not delay until it has received a written confirmation.

The payroll and prepaid deadline — the bulletin and §1005.18(e), stated separately

Payroll card accounts use the periodic-statement alternative described above, so the prepaid-account section states its own version of the error deadline. It is not worded the same way as the general rule in the section above. This page prints both versions that apply to payroll cards, each under its own source.

As the CFPB Bulletin 2013-10 states it: “Financial institutions must respond to a consumer’s report of errors regarding a payroll card account if the report is received within 60 days of the consumer either accessing account history or receiving a written account history on which the error appears, whichever is earlier, or within 120 days after the alleged error occurs.”

As Regulation E, §1005.18(e)(2)(i), states it: the financial institution shall comply with the requirements of §1005.11 in response to an oral or written notice of error received by the earlier of 60 days after the date the consumer electronically accesses the consumer’s account under paragraph (c)(1)(ii), provided the electronic account transaction history made available reflects the alleged error, or 60 days after the date the financial institution sends a written history of the consumer’s account transactions requested by the consumer under paragraph (c)(1)(iii) in which the alleged error is first reflected.

As Regulation E, §1005.18(e)(2)(ii), states the alternative: in lieu of following paragraph (e)(2)(i), a financial institution complies with the requirements for resolving errors in §1005.11 if it investigates any oral or written notice of error received within 120 days after the transfer allegedly in error was credited or debited to the consumer’s account.

What the institution must do after you report: investigation time, provisional credit, and the result

Provisional credit means money the institution puts back into your account for the time being, while it investigates. Provisionally means for now, subject to the investigation result.

Section 1005.11(c)(1) states the 10-day rule: a financial institution shall investigate promptly and, except as otherwise provided in paragraph (c), shall determine whether an error occurred within 10 business days of receiving a notice of error. The institution shall report the results to the consumer within three business days after completing its investigation. The institution shall correct the error within one business day after determining that an error occurred.

Section 1005.11(c)(2) states the 45-day rule: if the institution is unable to complete its investigation within 10 business days, it may take up to 45 days from receipt of a notice of error to investigate and determine whether an error occurred, provided it does the following:

• provisionally credits the consumer’s account in the amount of the alleged error (including interest where applicable) within 10 business days of receiving the error notice — with two stated limits: if the institution has a reasonable basis for believing an unauthorized electronic fund transfer has occurred and has satisfied the requirements of §1005.6(a), it may withhold a maximum of $50 from the amount credited; and it need not provisionally credit the account if it requires but does not receive written confirmation within 10 business days of an oral notice of error, or if the alleged error involves an account subject to Regulation T;
• informs the consumer, within two business days after the provisional crediting, of the amount and date of the provisional crediting and gives the consumer full use of the funds during the investigation;
• corrects the error, if any, within one business day after determining that an error occurred; and
• reports the results to the consumer within three business days after completing its investigation, including, if applicable, notice that a provisional credit has been made final.

Section 1005.11(c)(3) states the extensions: the time is 20 business days in place of 10 business days if the notice of error involves an electronic fund transfer to or from the account within 30 days after the first deposit to the account was made; and the time is 90 days in place of 45 days for completing an investigation if a notice of error involves an electronic fund transfer that was not initiated within a state, resulted from a point-of-sale debit card transaction, or occurred within 30 days after the first deposit to the account was made. Point-of-sale means the place where a purchase is made.

The CFPB’s “Know Your Rights” page states the provisional-credit point in shorter, general words for prepaid cards: the card provider is generally required by federal law to credit the disputed amount to your account while investigating the problem if the investigation will take longer than 10 business days. That general wording is printed here as the CFPB words it on that page. The detailed rule, with its conditions, is §1005.11(c)(2) above.

If the institution says no error, or a different error

Section 1005.11(d) states the steps the institution shall follow if it determines that no error occurred or that an error occurred in a manner or amount different from that described by the consumer.

Section 1005.11(d)(1) states the written explanation: the institution’s report of the results of its investigation shall include a written explanation of its findings and shall note the consumer’s right to request the documents the institution relied on in making its determination. Upon request, the institution shall promptly provide copies of the documents. The comments add that when a consumer requests copies, the institution must provide them in an understandable form — for example, by printing data held on magnetic tape and explaining any codes.

Section 1005.11(d)(2) states what must happen before a provisional credit is taken back. Upon debiting a provisionally credited amount, the institution shall notify the consumer of the date and amount of the debiting, and notify the consumer that it will honor checks, drafts, or similar instruments payable to third parties and preauthorized transfers from the consumer’s account, without charge to the consumer as a result of an overdraft, for five business days after the notification. It shall honor items as specified in the notice, but need honor only items it would have paid if the provisionally credited funds had not been debited. The comments state an alternative: the institution may comply by notifying the consumer that the account will be debited five business days from the transmittal of the notification, specifying the calendar date on which the debiting will occur.

Section 1005.11(e) states the reassertion rule: a financial institution that has fully complied with the error resolution requirements has no further responsibilities under this section should the consumer later reassert the same error, except in the case of an error asserted by the consumer following receipt of information provided under paragraph (a)(1)(vii). The comments add that a consumer who has voluntarily withdrawn an allegation of error has the right to reassert it unless the institution had already complied with all the error resolution requirements before the withdrawal, and the consumer must do so within the original 60-day period.

One more limit from the comments on §1005.11(c): if a billing error occurred, whether as alleged or in a different amount or manner, the financial institution may not impose a charge related to any aspect of the error-resolution process, including charges for documentation or investigation. The comments also state that a financial institution may make, without investigation, a final correction to a consumer’s account in the amount or manner alleged by the consumer to be in error, but must comply with all other applicable requirements of §1005.11.

Lost or stolen card, and transfers you did not allow

An unauthorized transfer, in full an unauthorized electronic fund transfer, is a transfer from your account that you did not allow. Liability means the amount of the loss you can be made to bear.

The bulletin states the payroll card point in one sentence: “Limited liability for unauthorized transfers: With limited exceptions regarding the period within which an unauthorized transfer must be reported, Regulation E’s limited liability protections fully apply to payroll cards.”

Ask CFPB’s page “What should I do if my prepaid card or PIN is lost or stolen or I see unauthorized charges?” states: “Contact the card provider right away if your card or your PIN is lost or stolen or if you see unauthorized charges.” A PIN is the personal number used with the card.

That page states the payroll card protection directly: “If you have registered your prepaid card, or if your card is a payroll card or a certain type of government benefit card, you have certain error resolution rights that protect you from unauthorized transactions under federal law.” It adds that some prepaid card providers give some additional protections for loss or theft, and that you should check your card provider’s website or your cardholder agreement to find out the specifics.

That page also states why speed matters: “Call your card issuer right away if your card or PIN is lost or stolen or if you see unauthorized charges. If you wait too long to report, you could be responsible for more or all of the unauthorized or incorrect charges. Prompt reporting of a card’s loss or an erroneous charge can also prevent additional losses from your account balance.”

The CFPB’s “Know Your Rights” page states the fraud and error protection in general words: you have protections in case of an error or an unauthorized transaction if you have a prepaid card that you have successfully registered; for example, you generally can’t be held responsible for unauthorized charges or other errors on these cards, if you report them immediately; and you should write down the number on the back of your card and call it as soon as you notice your card is missing, or notice charges you don’t recognize.

How much you can be made to bear: the liability tiers in §1005.6

Section 1005.6(a) states the conditions for liability: a consumer may be held liable, within the limitations in paragraph (b), for an unauthorized electronic fund transfer involving the consumer’s account only if the financial institution has provided the disclosures required by §1005.7(b)(1), (2), and (3). If the unauthorized transfer involved an access device, it must be an accepted access device and the financial institution must have provided a means to identify the consumer to whom it was issued.

The official comments on §1005.6(b) state that there are three possible tiers of consumer liability for unauthorized electronic fund transfers depending on the situation: (1) up to $50; (2) up to $500; or (3) an unlimited amount, depending on when the unauthorized transfer occurs, and that more than one tier may apply to a given situation. The tiers in the regulation text are these:

• Timely notice given — §1005.6(b)(1): if the consumer notifies the financial institution within two business days after learning of the loss or theft of the access device, the consumer’s liability shall not exceed the lesser of $50 or the amount of unauthorized transfers that occur before notice to the financial institution.
• Timely notice not given — §1005.6(b)(2): if the consumer fails to notify the financial institution within two business days after learning of the loss or theft of the access device, the consumer’s liability shall not exceed the lesser of $500 or the sum of $50 or the amount of unauthorized transfers that occur within the two business days, whichever is less, and the amount of unauthorized transfers that occur after the close of two business days and before notice to the institution, provided the institution establishes that these transfers would not have occurred had the consumer notified the institution within that two-day period.
• Periodic statement; timely notice not given — §1005.6(b)(3): a consumer must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution’s transmittal of the statement to avoid liability for subsequent transfers. If the consumer fails to do so, the consumer’s liability shall not exceed the amount of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution, and that the institution establishes would not have occurred had the consumer notified the institution within the 60-day period. When an access device is involved, the consumer may be liable for other amounts set forth in paragraphs (b)(1) or (b)(2), as applicable.

The comments on §1005.6(b)(3) state the unlimited point in plain terms: if a periodic statement shows an unauthorized transfer made with a lost or stolen debit card, the consumer must notify the financial institution within 60 calendar days after the periodic statement was sent; otherwise, the consumer faces unlimited liability for all unauthorized transfers made after the 60-day period. The consumer’s liability for transfers before the statement is sent, and up to 60 days following, is determined by the first two tiers.

For payroll and prepaid accounts that use the §1005.18(c)(1) alternative instead of periodic statements, §1005.18(e)(1)(i) states when the 60-day period in §1005.6(b)(3) begins: on the earlier of the date the consumer electronically accesses the consumer’s account under paragraph (c)(1)(ii), provided the electronic history made available reflects the unauthorized transfer, or the date the financial institution sends a written history requested by the consumer under paragraph (c)(1)(iii) in which the unauthorized transfer is first reflected. Section 1005.18(e)(1)(ii) states an alternative: the institution may comply by limiting the consumer’s liability as provided under §1005.6(b)(3) for any transfer reported by the consumer within 120 days after the transfer was credited or debited to the consumer’s account.

Section 1005.6 also states four further points:

• Extension for extenuating circumstances — §1005.6(b)(4): if the consumer’s delay in notifying the financial institution was due to extenuating circumstances, the institution shall extend the times specified above to a reasonable period. Extenuating circumstances means special circumstances that explain the delay.
• Notice to the institution — §1005.6(b)(5): notice is given when a consumer takes steps reasonably necessary to provide the institution with the pertinent information, whether or not a particular employee or agent of the institution actually receives the information; the consumer may notify the institution in person, by telephone, or in writing; and written notice is considered given at the time the consumer mails the notice or delivers it for transmission to the institution by any other usual means.
• State law or agreement — §1005.6(b)(6): if state law or an agreement between the consumer and the financial institution imposes less liability than is provided by this section, the consumer’s liability shall not exceed the amount imposed under the state law or agreement.
• Negligence — from the comments on §1005.6(b): negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E; consumer behavior that may constitute negligence under state law, such as writing the PIN on a debit card or on a piece of paper kept with the card, does not affect the consumer’s liability for unauthorized transfers. The comments also state that no agreement between the consumer and an institution may impose greater liability on the consumer for an unauthorized transfer than the limits provided in Regulation E.

Error rights notices you should receive

Section 1005.18(d)(1) states what an institution that provides information under the paragraph (c)(1) alternative must include in its initial disclosures, modified from §1005.7(b). Two items belong on this page:

• Access to account information — §1005.18(d)(1)(i): a telephone number the consumer may call to obtain the account balance, the means by which the consumer can obtain an electronic account transaction history, such as the address of a Web site, and a summary of the consumer’s right to receive a written account transaction history upon request, including a telephone number to call to request a history.
• Error resolution — §1005.18(d)(1)(ii): a notice concerning error resolution that is substantially similar to the notice contained in paragraph (b) of appendix A–7, in place of the notice required by §1005.7(b)(10).

Section 1005.18(d)(2) states the follow-up notice: the financial institution shall provide an annual notice concerning error resolution that is substantially similar to the notice in paragraph (b) of appendix A–7, in place of the notice required by §1005.8(b). Alternatively, it may include on or with each electronic and written account transaction history provided under paragraph (c)(1) a notice substantially similar to the abbreviated notice for periodic statements in paragraph (b) of appendix A–3, modified as necessary to reflect the error resolution provisions in paragraph (e).

Section 1005.18(f)(3) states one practical point: the name of the financial institution and the Web site URL and a telephone number a consumer can use to contact the financial institution about the prepaid account must be disclosed on the prepaid account access device. The comments explain that this information lets consumers, for example, contact the institution to learn the terms, obtain balance information, request a copy of transaction history under §1005.18(c)(1)(iii) if the institution does not provide periodic statements, or notify the institution when the consumer believes an unauthorized electronic fund transfer has occurred.

State law, only as the anchors state it

The anchors speak about state law in general only, so this page prints only that generality and names no state’s rule.

The bulletin states: “Most states’ laws contain additional restrictions on the manner in which employers may make wages available to their employees, sometimes specifically addressing payment of wages via payroll card, or calling for particular alternatives to payroll cards.” It also states that the EFTA and Regulation E preempt state laws relating to electronic fund transfers only to the extent of any inconsistency, and a state law is not considered inconsistent if the state law affords consumers greater protections than the EFTA and Regulation E. Preempt means federal law overrides state law. Affords means gives.

Section 1005.6(b)(6), quoted above, states the liability version of the same general point: if state law imposes less liability than §1005.6 provides, the consumer’s liability does not exceed the amount imposed under state law.

What this page does not cover

This page does not re-teach the companion page’s ground: whether an employer can require a payroll card, the alternatives an employer has to offer, the short form and long form disclosures, general fee examples, or the CFPB complaint route printed there. Those points are on “Can My Employer Force Direct Deposit?” and are not repeated here.

This page does not state any one state’s law, deadline, or penalty. The anchors describe state laws only in general.

This page does not cover pay timing, pay amounts, overtime, or deductions, and it does not cover credit features on a prepaid card. The sources read for this page were read for the payroll card history, error, and unauthorized-transfer rules only.

This page does not work out what any one person owes, or whether any one report was in time. It prints the rules, deadlines, and tiers as the anchors state them, with their conditions.

Words to know

Payroll card: A prepaid card arranged by an employer for the purpose of paying its employees’ wages or salary. That is the CFPB’s Ask CFPB wording. The bulletin also defines a payroll card account as an account established directly or indirectly through an employer, to which transfers of the consumer’s salary, wages, or other employee compensation are made on a recurring basis. Recurring means happening again and again.

Issuer / financial institution: The bank or other financial institution that issues the card and holds the account.

Account history: The record of the transactions on your account, including transaction information and the amount of any fees imposed, in the bulletin’s wording.

Periodic statement: The regular statement of the account record, as required by Regulation E generally under §1005.9(b).

Error resolution: The set of steps in §1005.11 that the financial institution must follow when you report an error, including investigation, provisional credit in the stated cases, and a report of the results.

Error: The list in §1005.11(a)(1): an unauthorized electronic fund transfer; an incorrect transfer; an omitted transfer; a computational or bookkeeping error by the institution; receipt of an incorrect amount from an electronic terminal; a transfer not identified as §1005.9 or §1005.10(a) requires; or a request for the documentation, information, or clarification described in §1005.11(a)(1)(vii).

Unauthorized transfer: In full, an unauthorized electronic fund transfer — a transfer from your account that you did not allow. §1005.11 and §1005.6 use the full term.

Access device: The card or other means used to reach the account, in the wording of §1005.6 and §1005.11.

Provisional credit: Money put back into your account for the time being while the institution investigates, under §1005.11(c)(2).

Electronic Fund Transfer Act (EFTA): The federal law the CFPB bulletin discusses. It generally covers the electronic transfer of funds to and from consumers’ accounts.

Regulation E: The rule that implements the EFTA, at 12 CFR part 1005.

This page is general information only. It is not legal advice.