To lock your bank account, open your bank’s mobile app and use the card controls to switch your debit card off, or call the customer service number on the back of your card (or visit a branch) to request a full account freeze. A card lock stops new purchases and ATM withdrawals on that card; a full freeze blocks nearly all activity on the account, including transfers and checks. Which one you need depends on what was actually exposed, and how fast you act determines how much money you can lose under federal law.
Decide Whether You Need a Card Lock or a Full Freeze
These are two different tools for two different problems.
A debit card lock is a toggle inside most banking apps. Flipping it off blocks new point-of-sale purchases, ATM withdrawals, and digital wallet transactions on that card. Recurring payments you already authorized, like subscriptions, utilities, and insurance premiums, often keep processing even while the card is turned off. A card lock also does nothing about electronic transfers, wire transfers, or forged checks pulled through other channels.
A full account freeze goes further. Your bank blocks outgoing transfers, check processing, debit card activity, and new electronic payments. It also blocks your own access and any incoming direct deposits.
If you only lost a physical card and have no reason to think your account number or online banking login was exposed, a card lock is usually enough. If you’re seeing unauthorized electronic transfers, unfamiliar payees, or evidence someone got into your online banking, ask for a full freeze instead.
Why Speed Matters
Federal law caps how much you can be held responsible for on unauthorized electronic transfers, but the cap depends on when you notify your bank.1eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
- Notify within two business days of learning the card was lost or stolen, and your maximum liability is $50 (or the total unauthorized amount if that’s less).
- Wait longer than two business days but report before your next statement, and liability can rise to $500.
- If unauthorized transfers show up on a periodic statement and you don’t report them within 60 days, you can be responsible for the full amount of any transfers occurring after that 60-day window.
An unauthorized transfer means one initiated by someone other than you, without your permission, and from which you received no benefit. It doesn’t include transfers by someone you handed your card or access code to, unless you already told the bank to revoke that access.2Office of the Law Revision Counsel. 15 USC 1693a – Definitions
One boundary worth knowing: these protections cover personal accounts held for personal, family, or household purposes. Business and commercial accounts are not covered by Regulation E and may not carry the same caps.3eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E
What to Have Ready Before You Contact the Bank
Gathering a few things first will keep the call short.
- Your account number, from a check, the app’s account details, or a recent statement.
- Identity verification: the last four digits of your Social Security number, security question answers, or a one-time code sent to the phone or email on file.
- Recent legitimate transactions with dates and dollar amounts, so the bank can confirm you’re the account holder and pinpoint where the unauthorized activity begins.
- The date and approximate time you first noticed the problem. This timestamp is what fixes your liability tier.
If you’re reporting unauthorized transactions rather than just a missing card, write down each one you didn’t authorize, with amounts, dates, and any visible merchant names.
Three Ways to Lock the Account
Through Your Banking App
This is the fastest option for a card lock. Look for a card management, security, or card controls section in the app menu. Most banks use a simple on/off toggle that immediately blocks new point-of-sale and ATM activity, with an on-screen confirmation that the card is disabled. A full account freeze usually isn’t available in the app, so if that’s what you need, call or go in.
By Phone
Call the customer service number printed on the back of your debit card or listed on your bank’s website. Choose the menu option for lost or stolen cards or fraudulent activity, which typically routes you to a specialized team. The representative can apply a card lock or a full administrative hold once your identity checks out. Ask for a reference or confirmation number before you hang up and write it down. The FTC recommends following the call with a written notice to your bank stating your account number, when you noticed the problem, and when you first reported it.4Federal Trade Commission. Lost or Stolen Credit, ATM, and Debit Cards
At a Branch
Going in person lets a banker flag your account directly in the internal system. Bring a government-issued photo ID. In the same visit, the banker can lock the card, freeze the full account, and start opening a replacement account or issuing a new card. Once entered, the restriction applies across every channel: online, mobile, ATM, and teller.
What Happens After the Lock
Your bank will typically send a push notification, text, or email documenting the time and date the restriction started. Your online banking portal may show a banner or icon indicating restricted status. Save those confirmations. They’re the evidence of when you notified the bank, which is exactly what your liability turns on.
Transactions already authorized before the lock may still process. A restaurant charge from earlier in the day or a pending online order can go through even after you switch off the card. With a full freeze, previously written checks and scheduled electronic payments will be blocked instead.
That creates a secondary problem: missed bills. If your mortgage, rent, utilities, or insurance premiums auto-pay from the frozen account, those payments will fail. Call each biller, explain what happened, and set up an alternative payment method. Most companies will waive late fees when the missed payment came from fraud-related account activity, and the sooner you call, the less likely you are to see service interruptions or negative credit reporting.
If scheduled payments bounce, you may also see non-sufficient-funds or returned-payment fees from your own bank. Ask for a reversal. Federal regulators have directed financial institutions to reimburse consumers for fees they could not reasonably anticipate or avoid, which gives you a reasonable basis to push back.5National Credit Union Administration. Consumer Harm Stemming from Certain Overdraft and Non-Sufficient Funds Fee Practices
Getting Your Money Back
Once you report unauthorized transactions, the bank has to investigate on a set clock.6eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
- The bank must complete its investigation within 10 business days of receiving your notice. If it finds an error, it must correct it within one business day.
- If it needs longer, it can extend to 45 days, but only if it provisionally credits your account for the disputed amount within the first 10 business days. It may withhold up to $50 from that provisional credit.
- The window extends to 90 days for point-of-sale debit card transactions, international transfers, and new accounts opened within the last 30 days. For new accounts, the provisional credit deadline also extends to 20 business days.
You’ll be notified of the provisional credit amount and date within two business days of it being applied, and you have full use of those funds while the investigation continues. If the bank concludes no error occurred, it can reverse the credit, but it has to give you written notice at least three business days beforehand and explain why. You can request copies of the documents the bank relied on.
Replacing the Account and Preventing a Repeat
If your account number itself was exposed, not just your card, you’ll likely need a new account with a new number. Ask the bank to transfer the remaining balance, close the old account, and issue a new debit card. Standard replacement cards are typically free; rush delivery may cost between $5 and $30 depending on the bank.
Once the new account is active, update every automatic payment and direct deposit tied to the old number: paychecks, government benefits, mortgage or rent, utilities, subscriptions, insurance. Missing one can leave you with a failed payment you don’t catch until it’s past due.
If someone used your personal information rather than just a card number, file a report at IdentityTheft.gov. The site generates an Identity Theft Report and a personalized recovery plan, and that report serves as proof to businesses and financial institutions that your identity was stolen.7Federal Trade Commission. Identity Theft Recovery Steps A police report isn’t always required but can strengthen your case with the bank.
A compromised bank account can also be a signal that broader information, like your Social Security number, is out. A credit freeze at Equifax, Experian, and TransUnion prevents new credit accounts from being opened in your name. It’s free and doesn’t affect your credit score. An initial fraud alert only requires contacting one bureau, which must notify the other two.8Federal Trade Commission. Credit Freezes and Fraud Alerts
After the immediate crisis, update your online banking password, turn on two-factor authentication, and set transaction alerts above a dollar threshold you choose.
Joint Accounts
If the account is jointly held, either owner can generally contact the bank to report fraud and request a lock or freeze. Removing the other person or closing the account, though, typically needs both owners’ consent, and state law and individual bank policies vary. Confirm with your institution what you can do on your own and what requires both signatures. If the fraud came from the other account holder, note that a transfer by someone you voluntarily gave access to isn’t considered unauthorized under federal law unless you previously told the bank to revoke that access.2Office of the Law Revision Counsel. 15 USC 1693a – Definitions