A merchant needs consumer consent before charging their debit or credit card for a purchase. But there are some gray areas where misunderstanding of the law can cause disputes
The editorial content below is based solely on the objective assessment of our writers and is not driven by advertising dollars. However, we may receive compensation when you click on links to products from our partners. Learn more about our advertising policy.
The content on this page is accurate as of the posting date; however, some of the offers mentioned may have expired. Please see the bank’s website for the most current version of card offers; and please review our list of best credit cards, or use our CardMatch™ tool to find cards matched to your needs.
Dear Your Business Credit,
Can a merchant legally debit a customer’s card without their knowledge or consent? — Stoney
The short answer is no. Merchants must get a customer’s permission to process charges on his credit or debit card under the Electronic Funds Transfer Act. Otherwise it is an unauthorized purchase. The law defines an unauthorized electronic funds transfer as one initiated by someone other than the consumer “without actual authority to initiate such transfer and from which the consumer receives no benefit.”
See related: Debit card fraud can leave you in the lurch
So how does a merchant get consent? When a customer comes into a store, swipes a signed credit card and signs the receipt, that is the most obvious type of consent. Filling out a form to make an online purchase or giving your debit card number by phone to a merchant are other types of consent.
However, the merchant must take certain steps for the transactions to be valid. Card networks such as Visa and MasterCard publish extensive rules for how merchants must properly process transactions, whether they conduct them in person or in situations where the card is not present.
One common source of complaint by consumers is the recurring charge. Under Regulation E, a set of rules for carrying out the Electronic Funds Transfer Act, merchants who are going to make a recurring charge — for instance, for a monthly gym membership payment — need to get advance consent that is in writing “or similarly authenticated” to make these charges and give the consumer a copy of the consent form. If the charges will not take place at set intervals, the merchant has to send the customer a notice of the amount and the date of the transfer at least 10 days before.
What if consumers want to stop these recurring payments? They must provide notice to their card issuer at least three days before the transfer. This notice can be verbal. The bank must honor this request regardless of the terms of the contract the customer signed. Banks are, however, allowed to require written notice from the consumer within 14 days to stop the payment. If they do this and the customer does not provide the notice, then the oral notice will no longer be binding.
See related: Can merchants charge large test payments?
One area where things get a little gray is when someone has let another family member or a friend use his card. The Electronic Funds Transfer Act says that if someone has furnished another person with the card, a code needed to use the card or another means of access to the account to make purchases, that second person’s transactions are considered authorized. That remains true unless the cardholder notifies the card issuer that this person is no longer authorized to use the card.
For instance, let’s say a mom gave her teenage child permission to use her card but the child used it irresponsibly. She doesn’t want merchants to accept the card from her child anymore. The mom would need to notify the credit card issuer in writing that the child is no longer permitted to use the card. Otherwise, the cardholder remains responsible for the child’s purchases.
Consumers who spot a charge they know they didn’t make on their card should contact the issuer as soon as possible. Otherwise, they may be held responsible for the charges.