If you got a prepaid debit card in the mail that you never asked for, it most likely came from one of four legitimate sources — a government payment, a former employer, a class-action settlement, or an insurance rebate — but it can also be a sign that someone opened an account in your name or is trying to phish your personal information. Sorting which one you’re holding, before you activate it or throw it out, is the whole task.
The Usual Legitimate Reasons
Federal and state agencies load payments onto prepaid cards when they don’t have your bank details on file. Treasury sent pandemic-era Economic Impact Payments this way, on Visa-branded cards issued through its financial agent MetaBank (now Pathward, N.A.), in white envelopes marked with the U.S. Treasury seal and the words “Economic Impact Payment Card” in the return address.1U.S. Department of the Treasury. Treasury Is Delivering Millions of Economic Impact Payments by Prepaid Debit Card States use the same method for tax rebates, inflation relief payments, and surplus refunds when direct deposit information is missing.
Employers are the next common source. A final paycheck, a delayed bonus, or a travel reimbursement can arrive on a payroll card, especially if you’ve already left the job and never gave the company bank information. These cards often come from a third-party processor rather than the employer, so a card branded Wisely by ADP, for example, may simply be the last money owed to you from a job you moved on from. Calling the company’s payroll or HR line will confirm the amount and, in most cases, let you request a transfer to your own bank.
Class-action settlement administrators increasingly pay small claims by prepaid card because it’s cheaper than cutting thousands of checks. You may have joined a case years ago and forgotten. The letter in the envelope should name the lawsuit, the defendant, and the settlement fund. Health insurers do something similar with Medical Loss Ratio rebates under the Affordable Care Act: when they’ve spent too little of your premium on actual care, they owe you the difference, and some send it on a prepaid card rather than a check.
Retailers also mail promotional cards, but those tend to be store-only, with small balances, and they’re only usable at that retailer. A card carrying a Visa or Mastercard logo and a meaningful balance points to one of the four categories above, not to marketing.
How to Tell a Real Card From a Scam
The paperwork does most of the sorting. A legitimate card arrives with a letter naming the issuing bank, the reason for the payment, and a customer service number. Government cards reference the specific program. Settlement cards name the case. Payroll cards identify the employer or processor. An envelope containing only a card and an instruction to “activate now” is the clearest warning sign there is.
Scammers mail cards, or card-shaped mailers, designed to harvest your information at the activation step. The number or website printed on the card routes to a phishing operation asking for a full Social Security number, bank routing details, or login credentials — data no real activation requires.2Consumer Advice (FTC). How To Recognize and Avoid Phishing Scams Before calling anything printed on an unexpected card, verify the issuer independently: search the bank name on the back, then call the number listed on the bank’s own website.
Specific red flags that the card is fake or a phishing attempt:
- No documentation at all, just a card and an activation prompt.
- Activation asks for your full Social Security number, bank routing number, or passwords. Real activation typically wants only the last four digits of your SSN or your ZIP code.
- Urgency language like “activate immediately or lose your funds.”
- An issuing bank you can’t find on the FDIC’s BankFind tool. If the bank doesn’t exist, neither does the card’s balance.
One quirk worth knowing: federal law prohibits mailing unsolicited credit cards, but that ban in the Truth in Lending Act covers credit cards specifically, and regulators have said prepaid cards without a credit feature don’t fall under it.3Consumer Financial Protection Bureau. 12 CFR 1026.12 Special Credit Card Provisions That gap is part of why fraudsters use prepaid cards in the first place.
When the Card Signals Identity Theft
A card with your correct name and address that you never applied for is one of the earliest warnings of identity theft. Criminals use stolen personal information to open prepaid accounts, often to route fraudulent unemployment benefits or government payments. The card lands at your address because your name is on the application; the thief plans to drain the funds before you catch on.
Fraudulent unemployment claims have been a common driver. Many victims first found out when a state-issued benefits card arrived for a claim they never filed. Report that kind of card to the state workforce agency where the claim was filed. The U.S. Department of Labor maintains a directory of state reporting contacts for this exact situation.4U.S. Department of Labor. Report Unemployment Identity Fraud Each state runs its own process, and some require a police report or sworn statement before they’ll investigate.
If you suspect identity theft, file at IdentityTheft.gov, the FTC’s dedicated portal, which produces a recovery plan and an official identity theft report you can use with creditors and agencies.5Federal Trade Commission. IdentityTheft.gov A police report adds a paper trail that helps if fraudulent tax returns or benefit claims surface later. Place a credit freeze with all three major bureaus. Under a 2018 amendment to the Fair Credit Reporting Act, freezes are free and stop anyone from opening new credit accounts in your name until you lift them.
Timing matters if fraudulent charges have already run through an account tied to you. Regulation E gives you 60 days from the date the financial institution sends a statement showing an unauthorized transfer to report it and trigger the investigation obligations that come with it.6Consumer Financial Protection Bureau. 12 CFR 1005.11 Procedures for Resolving Errors Once you report, the institution has 10 business days to investigate, or must provisionally credit your account while it takes up to 45 days to finish.7eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E) Miss the 60 days and you can be left holding the full loss.
What to Do When the Card Arrives
Work through this in order. Activating a fraudulent card can hand over your information; ignoring a legitimate one can cost you money that’s actually yours.
- Read the paperwork before you touch the card. Identify the issuing bank, the funding source, and the reason for the payment.
- Verify independently. Look up the issuing bank or agency through your own search. Do not use any phone number or link from the envelope.
- Check your own records for a matching employer, insurer, government filing, or class-action notice.
- If it’s legitimate, use the balance or transfer it to your bank account. Draining the card avoids ongoing fees and the risk of the balance eventually being turned over to the state.
- If it’s fraudulent, report it to the issuing bank, file at IdentityTheft.gov, contact your state workforce agency if unemployment benefits are involved, and freeze your credit with all three bureaus.8Federal Trade Commission. Report Identity Theft
- Destroy any card you’re discarding. Cut through both the magnetic strip and the chip so no one can pull the account data off it.
Pull your credit report while you’re at it. Legitimate prepaid cards don’t normally appear there, because no borrowing is involved. If a new credit account you didn’t open does show up, the fraud has already moved beyond prepaid cards into credit products, and you’ll need to dispute those accounts directly with each bureau.
Fees, Expiration, and Unused Balances
If the card turns out to be real and you set it aside, the money is protected for a while but not indefinitely. Federal law says funds on a general-use prepaid card cannot expire sooner than five years from the date the card was issued or the date money was last loaded onto it.9Office of the Law Revision Counsel. 15 USC 1693l-1 General-Use Prepaid Cards, Gift Certificates, and Store Gift Cards The plastic itself may carry an earlier printed date, but the issuer still has to make the remaining balance available, usually by sending a replacement card.
Fees are the other reason not to let a card sit. Government cards can charge for ATM withdrawals beyond the first, for balance inquiries, or for replacements. Monthly inactivity fees are restricted in many states but not all. Check the fee schedule in the paperwork before you start using the card, because a few avoidable charges can eat a small balance quickly.
If a card is never activated or used, the balance eventually escheats to the state under unclaimed property law. Dormancy periods range from one year to seven, depending on the state. You can still claim the money afterward through your state’s unclaimed property office, but it takes time. Using the card or moving the balance to your own account while it’s active is the simpler path.