Fifty

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

Inspiration

In 2024 people reported losing $12,537,194,708 to fraud to the FTC. In 2025 the CFPB received 7,960 checking and savings complaints about a "Transaction was not authorized", plus 4,538 credit card complaints about a card "charged for something you did not purchase".

The banks don't always follow the dispute rules either. Final CFPB orders include a $55 million penalty against Block, which runs Cash App, under Regulation E. Goldman Sachs paid a $45 million penalty and $19.8 million in redress over Apple Card disputes under Regulation Z.

The rules protect people well, but they're hard to use at the moment it counts. How much you can lose depends on how fast you report. If your card or login was stolen and you tell your bank within two business days of finding out, the most you can be held to is $50 (12 CFR 1005.6(b)(1)). Later, it can be $500. The bank's own deadlines then depend on whether you phoned or wrote, whether the account is new, and whether the payment started abroad. And the bank is the one deciding.

What it does

1. A few plain questions. Where the account is (US or UK), what kind of payment it was, who made it, whether a card, code or login was lost, and when you found out.

2. Which rule applies, and why. A credit card falls under Regulation Z. Someone else using your card or login, or tricking you into sharing a code, falls under Regulation E. A payment you made yourself after being deceived isn't covered by Regulation E, and Fifty says so and quotes the reason. Every answer comes with the rule, word for word.

3. The number and the date. A countdown ring shows the days left to keep your limit at $50, next to the tiers the regulation sets.

4. Your written notice, free. One tap makes the notice to your bank.

5. The bank's clock. Once you log that you told your bank, Fifty tracks its deadlines under 12 CFR 1005.11:

• 10 business days to investigate, or 20 for a new account;
• up to 45 days (or 90) if it provisionally credits you in time;
• 3 business days to tell you the result.

For credit cards it tracks the 30-day acknowledgment and the 90-day outer limit.

6. The Fifty Pack (one RevenueCat purchase):

• reminders when the bank's time runs out;
• written confirmation of a phone report;
• a request for the documents the bank relied on;
• a "your deadline has passed" letter;
• a complaint prep sheet and a case packet;
• more than one US dispute.

Always free: which rule applies with the quote, the most you can be held to, every deadline, reminders for your own deadlines, the written notice, and everything for UK payments.

How I built it

• Flutter for Android and iOS, Dart 3.10. Everything stays on the phone, with no bank connection, no account and no analytics.
• Verified rules only. assets/rules/us.json (27 rows) and uk.json (11 rows) each hold an exact quote, its citation, the source URL and the date it was checked. A script checks every quote against the saved source text. Card-network "zero liability" policies, remittance transfers and a UK bank holiday calendar were left out because I couldn't verify them.
• A pure engine in lib/rules/ takes the dispute and an explicit date, and never reads the clock.
• Two calendars. Regulation E counts business days by when your bank is open, and no fixed calendar is exact. Your own deadlines use an earliest calendar that counts every weekday. The bank's deadlines use a latest calendar that skips every federal holiday plus the weekday a bank might close in its place. Fifty only tells you you're late, or your bank is, when that's true under every reading.
• "Not sure" answers go to the side that protects you, and the result names the assumption.
• Tests: 206 unit and widget tests. The golden tests are named after the sentence of the rule each one proves, and a coverage test fails if any rule row is never reached. An integration test drives a full US debit card dispute on an emulator.
• Design: near-black with one lime accent, Space Grotesk for words and JetBrains Mono for every amount, date and countdown.

How Fifty uses RevenueCat

Why a one-time purchase. Someone who has just lost money shouldn't be put on a subscription, and charging for the notice that protects their rights would be wrong. So the protection is free, and one purchase covers the follow-up work.

UK disputes are never charged for. In the UK, charging to advise on or investigate a financial services claim is regulated claims management activity, so UK help is free information only.

Implementation:

• Product: fifty_pack, a non-consumable at $4.99, on the entitlement pack, in the default offering.
• Paywall: a RevenueCat Paywall, shown with RevenueCatUI.presentPaywallIfNeeded('pack'). If the paywall itself errors, the gateway buys the offering's package directly with Purchases.purchase(PurchaseParams.package(...)).
• Unlocking: Purchases.addCustomerInfoUpdateListener unlocks the pack as soon as the entitlement arrives.
• Restore: Purchases.restorePurchases(), from the pack screen and Settings.
• No key: the app runs fully, and locked items say purchases aren't set up in this build.

Screens depend on a PurchasesGateway interface with a fake for tests.

Challenges I ran into

• Business days that nobody can pin down. A "business day" under Regulation E is a day the bank is open, and every bank decides that for itself. Instead of guessing one calendar, Fifty works out both edges and only warns when both agree.
• No statement yet. Your 60-day clock runs from the statement, and many people haven't got one yet. A statement can't be sent before the payment it shows, so Fifty uses the payment date and labels the result as the earliest the deadline could be.
• Being tricked isn't always "unauthorized". A payment you sent yourself after a scam usually isn't covered by Regulation E. Saying that plainly, with the quote, was harder to write than a hopeful answer, but it's the honest one.
• One definition filled the whole screen. The Regulation E definition of an unauthorized transfer is long. Quotes now fold to four lines with "Read all of it" and a link to the source.

Accomplishments that I'm proud of

• Every limit and deadline in the app traces to a quoted sentence of a regulation, checked against its source.
• Fifty never says anyone is late unless that's true however the bank counts its days.
• It shipped. Fifty went live on 10 September 2026 and has 50 downloads across the App Store and Google Play.

What I learned

• The same scam can be fully covered or not covered at all depending on who pressed "send". The questions have to find that out before anything else.
• A free tier can be the whole product for most people, and a purchase can still be worth offering for the people whose bank drags its feet.

What's next

• Remittance transfer rules, once they're verified.

Built With

• flutter
• purchases-flutter
• purchases-ui-flutter
• revenuecat