If someone steals your credit card, lock it in your issuer’s mobile app, then call the number on the back of a statement or the issuer’s website to report the theft. Federal law caps your liability for unauthorized charges at $50, and every major card network reduces that to zero for consumer cards, but those protections turn on how fast you report. Every charge that posts before your call is one more transaction you’ll have to dispute; every charge after it is entirely the issuer’s problem.
Lock the Card in Your App First
Before you dial anyone, open your issuer’s app and look for a “lock card” or “freeze card” toggle. Most major issuers offer it, and it blocks new purchases in seconds while you gather details for the full report. A lock is a temporary hold, not a theft report. Recurring charges and transactions already in progress may still go through, and locking won’t trigger a new card number. Think of it as pulling the brake while you handle the rest.
Call Your Issuer to Report the Theft
The phone call is what officially starts the clock on your legal protections. Any unauthorized charges posted after that call are the issuer’s responsibility, not yours. Before you dial, pull together what you can from your app or recent statements:
- Your account number, since the physical card is gone. Check the app, online banking, or a paper statement.
- The date and time you last had the card, so the bank can separate your legitimate transactions from the fraudulent ones.
- Where it went missing: a restaurant, gym, gas station, or wherever you last used it.
- Any charges you don’t recognize, with exact amounts, dates, and merchant names from your transaction history.
The representative will cancel the compromised card number and start the replacement. You should receive a confirmation email or letter. Save it. That confirmation is your proof of when you reported the theft, and that date is what your liability turns on.
Send a Written Dispute Within 60 Days
Calling is the critical first step, but federal law reserves its strongest protections for written disputes. Under the Fair Credit Billing Act, you have 60 days from the date your statement was sent to submit written notice of any billing error, including unauthorized charges.1Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors Send the notice to the address your issuer designates for billing disputes, which is usually different from the payment address. Check the back of your statement or the issuer’s website for the right one.
Your letter should include your name, account number, the specific charges you’re disputing with amounts and dates, and a clear statement that you believe those charges are unauthorized. Send it by certified mail with return receipt so you have proof it arrived. Some issuers accept written disputes through their online portals, but a certified mail receipt gives you the strongest paper trail if the dispute drags on.
How Much You’re Actually on the Hook For
The Fair Credit Billing Act draws a clean line. Report the stolen card before any unauthorized charges post, and you owe nothing. If fraudulent charges post before you report it, your maximum liability is $50.2Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card That’s the legal ceiling, and most people never hit it. Visa and the other major networks apply a zero-liability policy that erases even that $50 for consumer cardholders.3Visa. Visa Zero Liability Policy
These protections also cover a stolen card number even when the physical card is still in your wallet, such as after a data breach or online fraud. If your account number was used but the card wasn’t lost, you aren’t responsible for any charge you didn’t authorize.4Federal Trade Commission. Lost or Stolen Credit, ATM, and Debit Cards
What the Issuer Has to Do Next
Once your issuer receives a written billing dispute, it must send a written acknowledgment within 30 days. The investigation itself must finish within two complete billing cycles, and never more than 90 days from when the issuer received your notice.5eCFR. 12 CFR 1026.13 – Billing Error Resolution Miss those deadlines and the issuer can lose the right to collect the disputed amount, even if the charge later turns out to have been legitimate.
While the investigation is open, you don’t have to pay the disputed portion of your bill, and that includes any interest or finance charges that accrued on those amounts.6HelpWithMyBank.gov. Can the Bank Apply Late Fees and Interest While My Billing Dispute Is Being Investigated? The issuer cannot report the disputed amount as delinquent or close your account just because you exercised your dispute rights.5eCFR. 12 CFR 1026.13 – Billing Error Resolution If it decides the charges were legitimate, it has to send a written explanation, and you can still disagree and request the documentation behind that decision.
Update Everything Tied to the Old Number
A new card number breaks every autopay attached to the old one. Streaming services, insurance premiums, gym memberships, utilities, cloud storage, and phone plans will all start failing once the old number is deactivated. Some card networks run automatic billing updaters that push new card details to participating merchants, but coverage is inconsistent. Don’t rely on it for anything you can’t afford to miss.
Pull your last two or three statements and list every recurring charge, then update each merchant manually once the replacement card arrives. Check digital wallets on your phone and any browser-saved payment methods. Missing an insurance payment can create a coverage lapse that costs far more than the hassle of updating a few accounts.
Protect the Rest of Your Identity
A stolen credit card is sometimes the visible tip of a larger problem. If your wallet was lifted, the thief may have your driver’s license, other cards, or enough personal information to open new accounts in your name. Even when only the card is gone, some guardrails are worth setting.
Fraud Alert or Credit Freeze
A fraud alert tells lenders to verify your identity before opening new credit in your name. You only need to contact one of the three major credit bureaus; that bureau is legally required to notify the other two. An initial fraud alert lasts one year and can be renewed. If you file an identity theft report with the FTC or a police report, you can request an extended fraud alert that lasts seven years.7Federal Trade Commission. Credit Freezes and Fraud Alerts
A credit freeze is stronger. It blocks anyone, including you, from opening new credit accounts until you lift it. Placing and lifting a freeze is free at all three bureaus, but you have to contact each one separately.8USAGov. How to Place or Lift a Security Freeze on Your Credit Report If you’re not planning to apply for new credit soon, a freeze is the more protective option, and you can lift it temporarily when you need to.
File an FTC Identity Theft Report
Reporting the theft at IdentityTheft.gov generates a personalized recovery plan with step-by-step instructions, pre-filled letters for creditors and bureaus, and an FTC Identity Theft Report you can hand to other institutions as documentation.9Federal Trade Commission. IdentityTheft.gov That report is also one of two documents that qualify you for the seven-year extended fraud alert.7Federal Trade Commission. Credit Freezes and Fraud Alerts A police report is optional for a straightforward stolen credit card, but it becomes useful if the theft involved a broader identity compromise, if you need documentation for a debt collector, or if you want the extended fraud alert and haven’t filed with the FTC.
Debit Cards Are Not the Same
Everything above applies to credit cards. If what was stolen is a debit card, the rules are meaningfully worse for you. The Electronic Fund Transfer Act uses a tiered liability structure that punishes slow reporting: $50 if you report within two business days, $500 if you report after that but within 60 days of your statement, and unlimited liability for unauthorized transfers that happen after that 60-day window.10Consumer Financial Protection Bureau. Comment for 1005.6 – Liability of Consumer for Unauthorized Transfers11eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
Debit fraud also drains your actual checking balance while the bank investigates. A credit card dispute puts a hold on someone else’s money; a debit dispute puts a hold on yours, and getting it back can take up to 10 business days for a provisional credit or up to 90 calendar days for the full investigation in some cases.12Consumer Compliance Outlook. Error Resolution and Liability Limitations Under Regulations E and Z If you carry both, that gap is the single best reason to use credit for everyday purchases and reserve the debit card for ATM withdrawals.