To lock your bank account, open your bank’s mobile app and toggle the debit card off for an instant card lock, or call the number on the back of your card (or visit a branch) to place a full freeze on the entire account. The app route takes seconds and blocks new card purchases and ATM withdrawals. A full account freeze goes further, stopping transfers, checks, and electronic payments, but it also blocks your own access. Which one you need depends on what was actually exposed, and how quickly you report the problem changes how much money you can lose.
Card Lock or Full Account Freeze
These are two different tools. A debit card lock, built into most banking apps, blocks new purchases, ATM withdrawals, and digital wallet transactions on that card. Recurring payments you previously authorized — subscriptions, utility bills, insurance premiums — often keep processing even while the card is off. A card lock also does nothing to stop someone from draining your account through electronic transfers, wire transfers, or forged checks.
A full account freeze blocks virtually all activity: outgoing transfers, check processing, debit card transactions, and new electronic payments. It’s the right response when your account number, routing number, or online banking credentials have been compromised, not just a physical card. The tradeoff is that it also blocks incoming direct deposits and any access you have.
Lost the physical card and nothing else? A card lock is usually enough. Seeing unauthorized electronic transfers, unfamiliar payees, or signs someone got into your online banking? Ask for a full account freeze.
Why Speed Matters
Federal law caps your losses from unauthorized electronic transfers, but the cap depends on how fast you notify your bank. Under Regulation E:
- Report within two business days of learning the card was lost or stolen: maximum liability is $50 (or the total unauthorized amount, if less).
- Report after two business days but before your next statement is sent: liability can rise to $500.
- Fail to report unauthorized transfers within 60 days after your statement is sent: you can be held responsible for the full amount of any transfers that occur after that 60-day window.
An “unauthorized electronic fund transfer” is one initiated by someone other than you, without your permission, from which you received no benefit. Transfers you allowed by handing someone your card or access code don’t count as unauthorized unless you told the bank to revoke that access.2Office of the Law Revision Counsel. 15 USC 1693a – Definitions
One boundary worth knowing: these protections cover only accounts held for personal, family, or household purposes. Business and commercial accounts fall outside Regulation E, and unauthorized transfers from them may not carry the same caps.3eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E
What to Have Ready
Gather these before you call or log in so nothing slows you down:
- Your full account number, from a paper check, the app, or a recent statement.
- Identity verification: the last four digits of your Social Security number, security question answers, or a one-time code sent to the phone or email on file.
- Recent legitimate transactions, with dates and dollar amounts, so the bank can distinguish yours from the fraudulent ones.
- A timeline: the date and approximate time you noticed the missing card, suspicious transaction, or compromised login. That timestamp anchors your liability under federal law.
If you’re reporting unauthorized transactions rather than just a missing card, write down each one you didn’t authorize, with amounts, dates, and merchant names.
Three Ways to Lock the Account
In the Banking App
The fastest option is the mobile app. Look for a section called “card management,” “security,” or “card controls.” Most banks use a simple on/off toggle: flipping it off immediately blocks new point-of-sale purchases and ATM withdrawals on that card, and the app displays a confirmation. If you need a full account freeze rather than a card lock, the app may not offer it, and you’ll need to call or visit a branch.
By Phone
Call the customer service number printed on the back of your debit card or listed on your bank’s website. Choose the menu option for lost or stolen cards or fraudulent activity; that usually routes you to a specialized team instead of the general queue. After verifying your identity, the representative can lock the card or place a full administrative hold on the account. Ask for a reference or confirmation number before hanging up and write it down. The FTC recommends following the call with a written notice to the bank that includes your account number, when you noticed the problem, and when you first reported it.4Federal Trade Commission. Lost or Stolen Credit, ATM, and Debit Cards
At a Branch
In person, a banker can flag your account as restricted directly in the internal system. Bring a government-issued photo ID. During the same visit, the banker can lock the card, freeze the account, and start opening a replacement account or issuing a new card. Once the restriction is entered, it takes effect across online, mobile, ATM, and teller channels.
After the Lock Is On
Your bank typically sends a push notification, text, or email confirming the time and date the restriction started, and your online portal may show a banner or icon indicating restricted status. Save those confirmations. They are your evidence of when you notified the bank, which drives your liability for any unauthorized transfers.
Transactions authorized before the lock may still process — a restaurant charge from earlier that day, a pending online order. With a full account freeze, previously written checks and scheduled electronic payments will be blocked too. That creates a secondary problem: auto-paid bills. Mortgages, rent, utilities, and insurance premiums scheduled to pull from a frozen account will fail. Call each biller, explain the situation, and arrange another payment method. Most will waive late fees when the missed payment traces to fraud-related account activity.
When scheduled payments bounce against a frozen account, you may see non-sufficient-funds or returned-payment fees. If the freeze caused them, ask your bank to reverse them. Federal regulators have directed institutions to reimburse consumers for fees they could not reasonably anticipate or avoid.5National Credit Union Administration. Consumer Harm Stemming from Certain Overdraft and Non-Sufficient Funds Fee Practices
Getting Unauthorized Money Back
Once you report unauthorized transactions, the bank must investigate on a fixed schedule:
- Within 10 business days of your notice, the bank must complete its investigation and decide whether an error occurred. If it finds one, it has to correct it within one business day.
- If the bank can’t finish in 10 business days, it can extend the investigation to 45 days, but only if it provisionally credits your account for the disputed amount within the original 10 business days. It may withhold up to $50 from that provisional credit.
- The deadline stretches to 90 days for point-of-sale debit card transactions, international transfers, or new accounts opened within the last 30 days. For new accounts, the provisional credit deadline also extends to 20 business days.
The bank must tell you the provisional credit amount and date within two business days of applying it, and you can use those funds while the investigation runs.6eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors If the bank ultimately finds no error, it can reverse the provisional credit, but it must send you written notice at least three business days before doing so and explain why. You can request copies of the documents it relied on.
Replacing the Account and Preventing a Repeat
If the account number itself was compromised, not just the card, you’ll likely need a new account with a new number. Ask the bank to transfer the remaining balance, close the old account, and issue a new debit card. Standard replacement cards are typically free; rush delivery may cost between $5 and $30 depending on the bank.
Once the new account is active, update every automatic payment and direct deposit tied to the old number: paychecks, government benefits, mortgage or rent, utilities, subscriptions, insurance. Missing one can produce a failed payment you don’t catch until it’s past due.
If someone used your personal information rather than only a card number, file a report at IdentityTheft.gov. The site generates an Identity Theft Report and a personalized recovery plan, and the report serves as proof to businesses and financial institutions that your identity was stolen.7Federal Trade Commission. Identity Theft Recovery Steps A local police report isn’t always required but can strengthen your case with the bank.
Because a compromised bank account can signal broader exposure of information like your Social Security number, consider a credit freeze at Equifax, Experian, and TransUnion. It’s free, doesn’t affect your credit score, and blocks new accounts from being opened in your name. An initial fraud alert requires contacting only one bureau, which must notify the other two.8Federal Trade Commission. Credit Freezes and Fraud Alerts After a few weeks of monitoring, update your online banking password, turn on two-factor authentication, and set transaction alerts above a threshold you choose.
Joint Accounts
If the account is joint, either holder can generally report fraud and request a lock or freeze. Removing the other person or closing the account entirely usually requires both owners’ consent, and state law and bank policy vary. If the fraud came from the other account holder, federal law adds a wrinkle: transfers by someone you voluntarily gave access to are not “unauthorized” unless you had already told the bank to revoke that access.2Office of the Law Revision Counsel. 15 USC 1693a – Definitions