How to Lock Your Bank Account: Card Lock vs. Freeze

To lock your bank account in the moment you suspect trouble, open your bank’s mobile app, go to card controls, and toggle the debit card off; the block takes effect immediately and stops new purchases and ATM withdrawals. That’s what most people mean when they search for how to lock your bank account, and it’s the right move for a lost card or a suspicious charge. A true account-wide freeze is a different tool, handled through the fraud department by phone or in a branch, and it’s what you want if someone has your account and routing numbers rather than just your card.

Card Lock vs. Full Account Freeze

A card lock disables your physical debit card. New point-of-sale purchases and ATM withdrawals get declined at the terminal. Recurring payments, direct deposits, and transfers already in motion keep processing, because those move through your account number rather than the card number. You can flip the lock on and off yourself, as many times as you need.

A full account freeze restricts activity on the account itself, including outgoing transfers and sometimes incoming deposits. Banks generally do not let you initiate this through the app. You call or visit a branch, and the bank may require a formal fraud affidavit before putting it in place.

If unauthorized charges are appearing from your physical card or card number, the card lock is what you need. If someone has accessed the account through other means, the fraud line is the faster route to a full freeze.

Locking the Card Through the App

Sign in to your bank’s mobile app. Most institutions require a second verification step beyond your password, such as a one-time code, before granting access to security controls.¹ Find the card management area. The label varies by bank: “Lock Card,” “Freeze Card,” or “Card Controls” under your checking account.

Select the specific card, especially if you have several linked to different accounts. Tap the toggle and confirm. The status changes immediately, and you’ll usually get a push notification or email confirming the lock. From that moment, any attempt to use the physical card is declined.

Digital Wallets Are Not Automatically Disabled

Locking the physical card does not lock the version stored in Apple Pay, Google Pay, or Samsung Pay. Transactions through those wallets can still go through after you lock the card.² If you think the card number itself was compromised, open each wallet and remove the card there too.

Locking by Phone or in Person

If the app isn’t an option, call the number on the back of your debit card or the bank’s main customer service line. The automated menu typically has a dedicated option for lost or stolen cards and fraud, which routes you to a team that can lock the card right away. You’ll verify identity through personal details like your Social Security number, date of birth, or recent transaction amounts.

A branch visit works too, though it’s slower. Bring a government-issued photo ID. The banker can implement the lock through the internal system and give you a printed confirmation. The identity verification standards banks use when you open an account apply to security changes in person as well.³

Whichever route you use, write down the date and time of your request and the name of anyone you spoke with. That timestamp affects your liability exposure.

What Still Works After a Card Lock

A card lock is narrower than most people assume. Knowing what keeps moving helps you avoid missed bills and surprise overdrafts.

Direct deposits still arrive. Paychecks and government benefits routed through ACH use your account and routing number, not the card.
Recurring ACH payments generally continue. Mortgage payments, insurance premiums, and other autopay bills tied to your account number keep processing.
Digital wallet transactions may still go through unless you remove the card from each wallet separately.²
Pending transactions authorized before the lock will likely still post.
New card-based purchases and ATM withdrawals are blocked. That’s the whole point.

To stop specific ACH debits, ask your bank about a stop payment on individual recurring charges or request a full account freeze.

Your Liability Depends on How Fast You Report

Federal law caps how much you can lose from unauthorized debit card transactions, but the cap gets dramatically worse the longer you wait. The Electronic Fund Transfer Act sets three tiers based on when you notify the bank after discovering the problem:

Within two business days of learning about the loss or theft: maximum liability of $50 or the amount taken before you notified the bank, whichever is less.⁴
More than two business days later but within sixty days of your statement: up to $500.⁴
More than sixty days after the statement was sent: unlimited liability for anything the bank could have prevented had you reported sooner.⁴

The two-day clock starts when you learn about the loss, not when the transaction posts. The sixty-day clock starts when the bank sends the statement showing the unauthorized charge. They run independently.

Credit cards work differently. Federal law caps your liability at $50 total, with no escalating tiers.⁵ With debit card fraud, the money is already out of your account, and you’re fighting to get it back.

Filing a Dispute for Charges That Already Went Through

Locking stops new damage. It doesn’t recover money already taken. For that, file a formal dispute.

Call the bank or use the app to report the specific unauthorized transactions. Give the date, amount, and merchant name for each charge. Note who you spoke with and when.

Watch this trap: if you report by phone, the bank can require written follow-up within ten business days. Skip that step and the bank is not required to provisionally credit your account during the investigation.⁶ Ask whether written confirmation is required, get the mailing address or secure message portal, send it promptly, and keep a copy.

Your written notice needs your name, account number, a description of why you believe an error occurred, and the type, date, and amount of each disputed transaction.⁷

What the Bank Owes You Once the Investigation Starts

Federal regulations set hard deadlines. The bank has ten business days to investigate and determine whether an error occurred. If it confirms the error inside that window, it must correct it within one business day and report results to you within three business days.⁷

If the bank needs more time, it can take up to forty-five days, but only if it provisionally credits your account for the disputed amount within the initial ten business days.⁷ The bank may hold back up to $50 from the provisional credit if it reasonably believes the transfer was unauthorized. It must notify you of the provisional credit within two business days and give you full use of the funds while it investigates.

If the bank concludes no error occurred, it can reverse the provisional credit, but it must notify you in writing at least three business days before doing so and explain why. You can request the documents the bank relied on.

Replacing the Card and Cleaning Up After

If you locked the card as a precaution and no fraud turned up, flip the toggle back in the app. The card reactivates immediately.

If the card was compromised, don’t unlock it. Ask for a replacement with a new number. Standard delivery typically takes seven to ten business days. Expedited shipping usually runs around $20, though cost varies by institution. If waiting is a problem, ask about temporary ATM-only access or using a digital wallet with the new card number before the physical card arrives.

Once the replacement arrives, update any merchants and services that had the old card on file for autopay. This is the step people forget, and it shows up weeks later as declined payments and late fees.

A few additional steps close remaining gaps. Change your online banking password and turn on two-factor authentication if it isn’t already active, because a card number obtained through a data breach often comes with other credentials. Review recent statements line by line, including small charges under a dollar that fraudsters use to test a stolen card. If you suspect identity theft beyond the card itself, place a free fraud alert or credit freeze with the credit bureaus. And keep monitoring the account for the next several months, because stolen card numbers can be sold to multiple buyers and reappear weeks later.

The sixty-day reporting window is a hard federal deadline, not a suggestion. Reviewing statements at least monthly is the most reliable way to stay inside it.⁴

1
Federal Financial Institutions Examination Council (FFIEC). Authentication and Access to Financial Institution Services and Systems
2
Bank of America. How to Lock or Unlock Your Debit Card With the Mobile Banking App
3
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
4
Office of the Law Revision Counsel. 15 US Code 1693g – Consumer Liability
5
Office of the Law Revision Counsel. 15 US Code 1643 – Liability of Holder of Credit Card
6
Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing From My Bank Account?
7
Consumer Financial Protection Bureau. Regulation E 1005.11 – Procedures for Resolving Errors