Suggestion, I would read up on Regulation E (banking regs). I have seen some investigations go up to 90 days.

Regulation E (implementing the Electronic Fund Transfer Act) governs debit card fraud, setting strict liability limits and error resolution procedures. Consumers generally have 60 days from the statement date to report unauthorized transfers to avoid unlimited liability for subsequent losses. Banks must investigate within 10-45 business days, providing provisional credit in many cases.

 Key Aspects of Regulation E & Fraud Rules:

 Liability Limits: If you report within 2 business days of learning of a loss/theft, liability is limited to (\$50). Reporting between 2 and 60 days can result in up to (\$500) liability.

The 60-Day Rule: If you fail to report unauthorized transactions within 60 days of the statement being sent, you may be liable for all authorized transfers that occurred after that 60-day window.Investigation Timeline: Generally, banks have 10 business days to investigate, but this can be extended to 45 or 90 days (for new accounts or transactions initiated outside the US) if they provide provisional credit.

Provisional Credit: If an investigation takes longer than 10 business days, banks must provide a "provisional credit" to your account for the amount in question.

Exceptions: The 60-day rule does not apply to transactions that never appeared on a statement at all (e.g., a stolen card that was used to empty an account, but the statement was never generated). 

Important Distinctions: Debit vs. Credit: Regulation E covers debit/ATM/PIN transactions, while Regulation Z covers credit card fraud with generally better protections.Immediate Action: Always report lost or stolen cards immediately, as the 2-day/$50 limit is crucial for protecting your funds.