Federal deadlines of two business days and 60 days shape what you might pay after a debit card is stolen. This timeline lays out what to do and when, from the first hour to the final report.
In a nutshell
- Report a lost or stolen debit card within two business days of learning of the loss and your liability is capped at the lesser of $50 or the unauthorized transfers themselves.
- After two business days, you could be responsible for up to $500, and once a statement shows an unauthorized withdrawal, you have 60 days to report it.
- Charges made after you report are not your responsibility, and the bank generally has ten business days to investigate an error once you notify it.
- Follow up in writing with your account details, when you discovered the card was gone and when you first reported it, and keep copies of the letter and your call notes.
- Under federal rules, carelessness such as writing your PIN on the card cannot be used to impose liability above the federal limits.
A stolen debit card gives a thief direct access to the money in your checking account, and the clock starts the moment you realize the card is gone. Federal law sets deadlines that determine how much of an unauthorized loss you might cover. This timeline walks through the first hour, the first two business days and the first 60 days, along with what your bank must do once you report.
Hour 1: Report the Missing Card to the Bank
Call your bank or credit union, or report through its mobile app, as soon as you notice the card is gone. Charges made after you report are not your responsibility under federal law, which is why the FTC advises acting immediately. The correct phone number appears on your monthly statement and in the help section of your account online, so keep the customer service number saved in your phone contacts.
During the call, note the date, time and the name of anyone you speak with, and ask the bank to confirm the old card has been canceled so it cannot be used for anything new.
Why the First Two Business Days Matter
The federal limits on your liability are built around two business days after you learn of the loss or theft. Report within that window and the bank cannot hold you responsible for more than the lesser of $50 or the amount of unauthorized transfers that happened before you notified it. Report after two business days and the picture changes: you could be responsible for up to $500 in unauthorized transactions. If you report before anyone uses the card, you are not responsible for any unauthorized transactions at all.
The same window applies if your PIN, the code you enter at ATMs and checkout terminals, is stolen rather than the card itself. Notifying the bank within two business days protects you from paying for transactions over $50 made by whoever stole it.
One rule often surprises people: carelessness cannot be used against you. Writing your PIN on the card, or on paper kept with it, does not let the bank impose liability beyond the federal limits.
Day 1 or 2: Check Recent Transactions and Lock the Card
Open your app or log in online and review recent activity. Look for purchases, ATM withdrawals or transfers you did not make, and report anything unfamiliar right away instead of waiting to see whether it resolves itself.
Many banks let you lock or freeze a card in the app, which blocks new transactions while you sort out which charges were yours. That does not replace reporting, but it can stop further use.
Keep checking your statements afterward, too. If you spot a charge you did not make, report it right away; waiting could mean paying for the charges or losing the money withdrawn from your account.
Within 60 Days: Review Statements for Unauthorized Charges
Reporting the card does not end your part. If a statement shows an unauthorized withdrawal, you have 60 days from that statement to notify the bank. Wait longer and you could have to pay the full amount of transactions that occurred after the 60-day period and before you told the bank. To hold you responsible for those, the bank has to show they would not have happened if you had notified it in time.
This also covers a separate situation: the card was never lost, but an unauthorized charge shows up anyway. Notify the bank right away, and no later than 60 days after the statement showing it.
Filing a Written Report and What the Bank Must Do Next
A phone call starts the process; a letter documents it. Follow up in writing to the address the bank uses for errors on debit card accounts. Your letter should list your account number, the moment you discovered the card was gone and the time of your first report, and keep copies of the letter and your call notes.
Once you notify the bank, it generally has ten business days to investigate. If it determines an error occurred, it must correct it within one business day and then report its findings to you within three business days. The law places the burden of proof on the financial institution to show that a transfer was authorized or that the conditions for holding you liable were met.
Do this
Save your bank’s customer service number in your phone before you need it, so you can reach the right department quickly if a card goes missing.
After the Case: Replacement Card and New PIN
The bank should cancel the compromised card and send a replacement with a new number. Activate it and choose a PIN that is not easy to guess, then never write it on the card or keep it in your wallet. Update automatic payments tied to the old number so bills do not go unpaid, and keep checking the account for a while afterward.
If the Bank Says You Are Liable: Your Next Options
Ask the bank to explain in writing how it calculated your liability and which deadline it believes you missed. If you still disagree, remember that no agreement with your bank can impose greater liability than the federal limits allow, and those limits depend only on how quickly you reported. If the theft looks like broader identity theft, the FTC’s IdentityTheft.gov site offers a report and a recovery plan. Check your credit reports for accounts or charges you do not recognize, and ask your insurer whether homeowner’s or renter’s coverage applies.
Timing drives outcomes in most payment problems. If money left your account another way, our article on what happens when you send money to the wrong person covers a common mistake, and our timeline for a missing wire transfer explains what to expect when a transfer does not arrive.
Good questions
What happens if I report my debit card stolen before anyone uses it?
Federal law says you are not responsible for any transactions you did not authorize if you report the loss before the card is used. That is the strongest position to be in, which is why acting in the first hour matters.
How are the two business days counted?
The federal limits are written in business days after you learn of the loss or theft. Rather than debate the counting, report as soon as you notice the card is missing, since prompt reporting can also prevent additional losses from your balance.
Can the bank hold my carelessness against me?
Under the federal rules, negligence such as writing your PIN on the card cannot be used to impose liability greater than the federal limits. How quickly you report is what sets the limit.
What if the thief has my PIN but not my card?
Notify your bank within two business days of discovering the theft of your security code or PIN. Reporting within that window protects you from paying for transactions over $50 charged by whoever stole and used it.
This guide is general information, not financial or legal advice. Bank fees, account terms and screening policies vary by bank and change over time, so check the account’s fee schedule and terms before you open it. For federal rules, see the Consumer Financial Protection Bureau and the FDIC.