Disclaimer. This is not legal advice, simply consumer information:

While credit cards are subject to the more consumer friendly Truth In Lending Act (your maximum liability for loss/fraud is $50) and the Federal Reserve Board's Regulation Z, an ATM or debit card is subject to the FRB Regulation E, implementing the Electronic Funds Transfer Act (EFTA). Full legalese of Regulation E (an "access device" is an ATM/debit card) here; easy to read Fed fact sheet here. If your ATM/debit card is used fraudulently, there is a 3-tiered system of liability -- if you notify the bank within two days, your liability is $50, within 60 days, $500, and after that, as much as all the money in your account and other accounts (e.g, savings) or over-draft lines of credit linked to it. Worse, of course, you are fighting to get your own money back.

The banks, of course, have promoted their much ballyhooed voluntary schemes purporting to limit your liability to either zero or $50, same as a credit card. These claims are subject to asterisks and exceptions.

Regardless, however, of whether banks are sometimes honoring those purported voluntary liability limits, some banks and credit unions are also denying legitimate claims of fraud, where the consumer does make timely notice ("Sorry, your son wasn't authorized. Too bad he supposedly lost the card" OR "you must have given up your PIN, you lose.") Don't put up with these sorts of "go away" responses. The law requires an adequate and timely investigation and the law describes the circumstances under which you can be held liable. These may or may not be among them, depending on the facts. That's why you need to copy the regulators, so the bank (1) knows you mean business and (2) the regulators know that these problems are occurring and can review the investigation and disposition of your complaint.

You must, if you are a victim of debit card fraud, notify the bank immediately and keep copies of all documents as well as a written log of your interactions with the bank. We advise also sending copies of all communications with the bank to the bank's primary regulator. It lets the bank know you aren't willing to put up with any shenanigans.

Also send copies to the Federal Reserve Board here. If a bank has national in its name or NA after its name, it is regulated by the Office of the Comptroller of the Currency (OCC) which regulates most bigger (and a lot of smaller) banks. You can get a list of the other regulatory agencies here.

The fed’s general consumer fact sheet on Regulation E is here explaining your EFTA rights. PIRG's factsheet is here.