To report a lost or stolen credit or debit card, contact your issuer immediately through its mobile app, website, or the phone number on the back of another card or a recent statement, then follow up in writing. Federal law caps your liability for unauthorized credit card charges at $50 no matter when you report, but debit card liability stays at $50 only if you notify the bank within two business days of learning the card is missing. After that, debit losses can climb to $500, and past 60 days from your statement, potentially everything in the account.
Lock the Card First, Then Decide Whether to Report
Most banks let you instantly lock a card from their mobile app or online portal. A lock blocks new purchases and cash advances while you check the couch cushions and retrace your steps. Recurring payments usually keep processing through a lock, so a mortgage or utility autopay won’t fail while you look. If the card turns up, unlocking takes seconds and you avoid a new card number and the chore of updating every account tied to it.
A lock is a pause, not a fix. If the card is genuinely gone or you think someone else has it, reporting it lost or stolen is the step that matters. Reporting cancels the old number for good and starts a replacement. The federal liability clock runs from when you learn the card is missing, not from when you formally report, so the sooner you make the report, the smaller your exposure.
How to Report a Lost or Stolen Card
Major issuers accept reports around the clock through three channels:
- Mobile app or website. Look under card management or security settings for an option like “Report Lost or Stolen.” Usually the fastest route because there’s no hold time.
- Phone. Call the number on the back of another card from the same issuer, or the fraud line printed on a recent statement. Automated systems verify your identity before routing you to the fraud department.
- Written follow-up. After you report by phone or app, send a letter to your issuer with your account number, the date and time you noticed the card was missing, and when you first reported the loss. Keep a copy.
The FTC specifically recommends following up any phone or app report with written notice. That paper trail protects you if there’s later a dispute about when you reported. Saving your bank’s fraud number in your phone contacts now means you’re not hunting for it during an emergency.
What You’ll Need to Have Ready
Since the card itself is gone, pull your account number from a recent statement, a saved PDF in your bank’s portal, or the app. The bank will verify your identity through security questions, a PIN, or biometric login in the app. Details about your last few legitimate transactions help, since fraud teams sometimes ask you to confirm recent activity to separate your purchases from unauthorized ones.
Reporting From Overseas
Toll-free U.S. numbers don’t work from most foreign countries. Visa and Mastercard each maintain global collect-call numbers for reporting lost cards internationally, listed on your issuer’s website. Save them before any trip. Many banks can also arrange emergency cash advances or temporary card numbers through their international assistance lines.
Credit Card Liability: $50 Maximum, No Deadline
Federal law limits your liability for unauthorized credit card charges to $50. Under 15 U.S.C. ยง 1643, a cardholder is only liable for unauthorized use that happens before the issuer is notified, and even then the liability cannot exceed $50.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Once you report the card missing, you owe nothing for any charges made after that point.
There’s no reporting deadline for credit cards. Waiting a week or a month doesn’t raise the cap; your maximum exposure remains $50 for charges made before you called it in. Waiting still makes disputes messier and gives thieves more time to run up charges, which can slow resolution.
The $50 cap only applies if the issuer provided you with notice of potential liability and a way to report the loss. The burden of proving those conditions were met falls on the issuer.1Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card In practice, if there’s any question about whether you or someone else made a charge, the issuer carries that burden.
Debit Card Liability: Timing Changes Everything
Debit cards follow different rules under the Electronic Fund Transfer Act, and how fast you report has direct financial consequences. Liability tiers work like this:
- Within two business days of learning the card is missing, your liability is capped at $50 or the actual amount of unauthorized transfers before you notified the bank, whichever is less.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- After two business days but within 60 days of your statement, liability can rise to as much as $500 for unauthorized transfers that occurred after the two-day window closed.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Beyond 60 days after your statement is sent, you can lose everything. The bank has no obligation to reimburse losses it can show wouldn’t have happened if you’d reported on time.2Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
The statute allows extra time in extenuating circumstances like extended travel or hospitalization, requiring only that the consumer report within a “reasonable” period. Relying on that exception is a gamble. The two-day window is what matters, and it starts the moment you learn the card is gone, not when the first fraudulent charge shows up.
Your Bank Must Investigate and Issue Provisional Credit
After you report an unauthorized debit transaction, the bank can’t sit on your complaint. Under federal law, it must investigate and report results within ten business days.3GovInfo. 15 USC 1693f – Error Resolution If it needs more time, it can extend the investigation to 45 days, but only by provisionally crediting your account for the disputed amount within those first ten business days.4Consumer Financial Protection Bureau. Regulation E 1005.11 – Procedures for Resolving Errors You have full use of those funds while the investigation continues. The bank may withhold up to $50 from the provisional credit if it has a reasonable basis to believe unauthorized use occurred.
If your bank drags its feet or refuses to provisionally credit your account while investigating, it’s violating federal law.
When the Number Is Stolen but the Card Is Still in Your Wallet
Sometimes the card is safe in your pocket but unauthorized charges appear on your statement, usually because someone captured your number through a data breach, a skimmer, or an online hack. The liability rules are more generous here.
For credit cards, you aren’t responsible for any charges you didn’t authorize when only the number was compromised. For debit cards, you’re protected from unauthorized transactions as long as you report them within 60 calendar days after your statement is sent.5Consumer Advice – FTC. Lost or Stolen Credit, ATM, and Debit Cards The two-business-day window doesn’t apply because there was no physical card to lose. Reading your statements regularly is the only way to catch this kind of fraud before the 60-day window closes.
Network Zero Liability Policies
The federal caps are the legal floor. Major card networks have voluntarily gone further with zero liability policies that effectively eliminate the $50 cap for most cardholders.
Visa’s policy covers both credit and debit cards and applies whether the unauthorized charge happened in a store, online, or at an ATM.6Visa. Visa Zero Liability Policy Mastercard’s protection similarly covers in-store, phone, online, and mobile transactions.7Mastercard. Zero Liability Protection Discover guarantees that cardholders are “never responsible for unauthorized purchases.”8Discover. Credit Card Fraud and Account Protection
These policies come with conditions. You need to have used reasonable care with the card and reported the loss promptly. They also don’t cover certain commercial cards or anonymous prepaid cards like gift cards.7Mastercard. Zero Liability Protection For most consumers with personal Visa, Mastercard, or Discover cards, the network policy means the federal $50 cap is a backstop that rarely comes into play.
Business Cards Don’t Get the Same Protections
If the missing card is a business debit card, the federal protections above likely don’t apply. The Electronic Fund Transfer Act covers accounts established primarily for personal, family, or household purposes.9Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs A business checking account doesn’t meet that definition. Your liability depends on the contract with your bank, and those terms are often far less generous than consumer protections.
Business credit cards are somewhat different. The federal $50 cap under the Truth in Lending Act applies to any “cardholder,” which includes business card users. But the network zero liability policies from Visa and Mastercard specifically exclude certain commercial products. If your company issues cards to employees, read the cardholder agreement to see what protections actually apply.
What Happens After You Report
Once your report is logged, the issuer deactivates the old card number immediately. No new charges can go through. A replacement card with a new number and security code typically arrives by mail within five to seven business days. Most issuers offer expedited shipping for a fee, and some waive that fee when a card was stolen.
The account itself stays open. The replacement links to the same account, so your credit limit, payment history, and account age are unchanged. Reporting a card lost does not close your account and does not affect your credit score. Only the card number and expiration date change.
Updating Recurring Payments and Digital Wallets
A new card number means every subscription, autopay, and saved payment method tied to the old number needs updating. This is the piece most people underestimate. Miss one and you might not notice until a payment bounces or a service gets canceled.
Some merchants participate in automatic card updater services run by Visa and Mastercard. These systems push your new details to participating merchants behind the scenes, so some subscriptions keep working with no action from you. Coverage is patchy. Smaller merchants, utility companies, and government payment portals often don’t participate.
Review the last two months of statements to build a list of every recurring charge. Common ones that usually need manual updates include streaming services, insurance premiums, gym memberships, cloud storage, and online retailers where you’ve saved payment information. Digital wallets like Apple Pay, Google Pay, and Samsung Pay use tokenization that often lets you keep making contactless payments while you wait for the physical card.10Mastercard. Tokenization Explained – Protecting Sensitive Data and Strengthening Every Transaction Your bank may automatically update the token in your wallet, but it’s worth checking.
If You Think the Card Was Stolen, Not Just Lost
A missing card doesn’t automatically mean identity theft, but if you believe it was stolen, take precautions beyond just reporting to your bank.
A fraud alert is the lightest option. Contact one of the three major credit bureaus and that bureau notifies the other two. An initial fraud alert lasts one year, costs nothing, and tells lenders to verify your identity before opening new accounts in your name.11Consumer Advice – FTC. Credit Freezes and Fraud Alerts Placing one also entitles you to a free copy of your credit report from each bureau.
A credit freeze is the stronger option. It blocks anyone, including you, from opening new credit accounts until you lift the freeze.11Consumer Advice – FTC. Credit Freezes and Fraud Alerts Freezes are free and stay in place until you remove them. If your wallet also contained a driver’s license or other identifying documents, a freeze is the smarter choice.
If unauthorized accounts do appear on your credit report, the FTC’s IdentityTheft.gov site generates a formal Identity Theft Report and walks you through a personalized recovery plan, including pre-filled dispute letters.12Federal Trade Commission. IdentityTheft.gov – Report Identity Theft and Get a Recovery Plan Filing a false identity theft report is a federal crime, so this tool is for situations where unauthorized activity has actually occurred.