What Can Someone Do With Your Debit Card Number?

If someone has your debit card number, they can shop online and over the phone in your name, encode the number onto a blank card to use in stores, sign your account up for recurring subscriptions, call you while posing as your bank to pry loose your PIN or login, or sell the number to another criminal who does all of the above. What can someone do with your debit card number matters more than the equivalent question about a credit card, because every unauthorized debit charge pulls cash straight out of your checking account. Federal law caps your losses, but only if you report the fraud quickly.

Online and Phone Purchases

The most common use of a stolen debit card number is buying things online or by phone, where no one asks to see the plastic. A thief with your 16-digit number, the expiration date, and the three-digit code on the back can check out at thousands of retailers. Some merchants with weaker fraud controls skip billing-address verification entirely, which makes the checkout even easier for a criminal holding stolen credentials.

The difference between this and credit card fraud is timing. A fraudulent credit charge sits as a pending balance you can dispute before paying. A fraudulent debit charge removes money from your checking account right away. If the balance dips too low, legitimate payments you already scheduled — rent, utilities, loan payments — can fail or trigger overdraft fees before you notice anything is wrong.

Visa and Mastercard both publish zero-liability policies that go beyond the federal minimums for their branded debit cards. The coverage has exceptions. Visa’s zero-liability protection does not apply to commercial card transactions, anonymous prepaid cards, or transactions not processed over the Visa network.¹ Coverage can also be withheld or delayed if the cardholder was grossly negligent or waited too long to report. These are voluntary network policies rather than legal guarantees, and the terms can change.

Cloned Cards for In-Store Use

A stolen card number does not have to stay digital. Criminals can encode your data onto the magnetic stripe of a blank plastic card, creating a working replica. Cloning lets someone walk into a store and swipe the copy as if it were your original card. EMV chip technology was designed to stop this, but many terminals still allow a magnetic-stripe swipe as a backup when the chip reader fails, and that fallback is what cloned cards rely on.

At checkout, a thief using a cloned card typically selects “credit” rather than “debit.” Credit routing needs only a signature, and sometimes nothing at all, so no PIN is required. The charge still hits your checking account. Retailers that have not disabled magnetic-stripe fallback at their terminals are the most frequent targets.

Social Engineering Calls

A stolen card number is sometimes more valuable as a psychological tool than as a payment method. A fraudster may call or text pretending to be your bank’s fraud department. By reading your card number back to you — information a real bank representative would know — the caller creates a convincing illusion of legitimacy.

The point is to use that false trust to extract the missing pieces: your PIN, a one-time verification code, or your online banking password. Once you believe you are speaking with a real investigator and share those details, the criminal gains full control of the account, not just the ability to make purchases. They can transfer funds, change your login credentials, and lock you out. This kind of attack is far more damaging than simple purchase fraud because it hands over the whole account.

Fraudulent Subscriptions and Recurring Charges

Criminals also use stolen numbers to sign up for subscription services, streaming accounts, or “free trial” offers. The enrollment often starts with a tiny charge, sometimes under a dollar, meant to verify that the account is active without catching your attention. If that test charge clears, the thief either resells the subscription access or lets larger monthly charges begin. Because these amounts are small compared to most checking balances, they can continue for months if you do not review your transactions.

Canceling the compromised card and receiving a replacement does not always stop the charges. Major card networks operate account-updater services that automatically share your new card number and expiration date with merchants who have your card on file for recurring billing.² The service is meant to keep your legitimate subscriptions running after a card swap, but it also means a fraudulently enrolled subscription may keep billing your new card. To stop unwanted charges you need to contact both your bank and the merchant. Some banks let you opt out of the account-updater service, but this varies by institution.

Resale on Dark Web Marketplaces

Stolen debit card numbers are frequently sold in bulk on dark web marketplaces. Thieves bundle card data into large sets and sell them to buyers who then carry out the actual fraud. The first six digits of your card number, called the bank identification number, tell a buyer which bank issued the card and roughly what kind of account is attached. Cards tied to premium checking accounts tend to sell for more because buyers assume the balance is higher. The person who originally stole your data is rarely the same person who uses it.

Your Liability Depends on How Fast You Report

Federal law limits how much you can lose to unauthorized debit card transactions, but the protection shrinks the longer you wait. The Electronic Fund Transfer Act and its implementing regulation, Regulation E, set three liability tiers based on when you notify your bank:

Within two business days of learning about the fraud, your maximum liability is $50, or the amount of unauthorized transfers that occurred before you notified the bank, whichever is less.³
Between two and 60 days, your liability can rise to $500 for unauthorized transfers that happened after the two-day window but before you notified the bank.⁴
After 60 days from when your statement was sent, you could lose everything taken from your account after that deadline, with no cap.⁴

These protections apply only when the transfer was truly unauthorized. Your bank must also have given you the required disclosures about your rights and provided a way to identify the authorized cardholder for the liability limits to apply.⁵ The statute allows extensions of the reporting deadlines in extenuating circumstances like hospitalization or extended travel.

How the Bank Investigation Works

Once you report unauthorized transactions, your bank has 10 business days to investigate and decide whether an error occurred.⁶ If the bank resolves the claim within that window, it must correct the error within one business day of its determination and report the results to you within three business days.

If the bank cannot finish in 10 business days, it may take up to 45 days, but only if it provisionally credits your account within those first 10 business days.⁶ The provisional credit covers the full disputed amount minus up to $50, and you have full use of those funds during the investigation. The window extends to 90 days for transactions that took place outside the United States, point-of-sale debit card purchases, or transfers within 30 days of your account being opened.

Your bank can ask you to follow up your phone call with a written confirmation of the disputed transactions. If the bank makes this request and you do not submit the written statement within 10 business days, the bank is not required to provisionally credit your account during its investigation.⁶ The bank must tell you about this requirement and provide the address for your written statement when you make the initial oral report.⁷

Overdraft Fees and Other Cascading Harm

Unauthorized charges that push your account below zero can trigger overdraft fees, returned-payment fees, and late charges on bills that fail to process. Under Regulation E, when your bank determines that an unauthorized transfer did occur, it must refund any fees it charged as a result of the error, including overdraft fees.⁸ The bank does not have to refund fees it would have charged regardless of the fraud, such as a monthly maintenance fee.

The harder problem is third-party damage. If your rent payment bounces because a thief drained the account, your bank can refund its overdraft fee, but your landlord’s late fee, or a hit to your payment history with another creditor, is a separate issue the bank is not responsible for. Rebuilding that goodwill falls on you: calling each biller, explaining what happened, and asking for waivers. Reporting quickly and securing provisional credit is how you keep this cascade small.

Business Debit Cards Are Not Covered

Regulation E’s protections, including the $50 cap, provisional credit, and investigation timelines, apply only to accounts established primarily for personal, family, or household purposes.⁹ A debit card tied to a commercial checking account is not covered. Business disputes are instead governed by Article 4A of the Uniform Commercial Code, which most states have adopted. Under Article 4A, a bank that accepted an unauthorized payment order is generally required to refund the customer only if the bank’s security procedures were commercially reasonable and the customer was not at fault for the breach.¹⁰ A business owner facing debit card fraud may have a harder time recovering funds and has no federal right to provisional credit during the investigation.

What to Do If Your Number Is Compromised

Speed is the single most important factor. Every day you wait raises both your potential liability under federal law and the real-world damage to your account. The Office of the Comptroller of the Currency recommends the following steps:¹¹

Call your bank right away using the number on the back of your card or through the bank’s app. Report the unauthorized charges, have the card blocked, and ask for a replacement with a new number.
If the bank asks for written confirmation, submit it within 10 business days to preserve your right to provisional credit during the investigation.⁶
Place a fraud alert on your credit reports by contacting any one of the three major credit bureaus (Equifax, Experian, or TransUnion); that bureau will notify the other two. The alert makes it harder for someone to open new accounts in your name.
File an identity theft report at IdentityTheft.gov to receive an official FTC Identity Theft Report and a personalized recovery plan. The report can serve as documentation when dealing with your bank or other creditors.¹²
File a police report with your local law enforcement agency. Some banks and creditors require one as part of the dispute process.
Review at least 60 days of transaction history for anything you do not recognize. Reporting every unauthorized transaction within the 60-day window after your statement is sent protects you from unlimited liability.³
Contact any merchant the thief signed you up with and cancel the subscription directly. Because account-updater services can forward your new card number to merchants automatically, simply replacing the card may not stop the recurring charges.²

1
Visa. Visa’s Zero Liability Policy
2
Visa Developer. Visa Account Updater Overview
3
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
4
Consumer Financial Protection Bureau. 1005.6 Liability of Consumer for Unauthorized Transfers
5
Office of the Law Revision Counsel. 15 U.S. Code 1693g – Consumer Liability
6
Consumer Financial Protection Bureau. 1005.11 Procedures for Resolving Errors
7
Consumer Financial Protection Bureau. How Do I Get My Money Back After I Discover an Unauthorized Transaction or Money Missing from My Bank Account
8
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
9
GovInfo. 15 U.S. Code 1693a – Definitions
10
Legal Information Institute. U.C.C. Article 4A – Funds Transfer
11
Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud
12
Federal Trade Commission. IdentityTheft.gov