If you leave your card in an ATM, the machine will almost always pull it back inside within about 15 to 30 seconds and hold it in a locked internal bin, where bank staff will log it and destroy it rather than return it. That built-in retraction protects the card from the next person in line, but it does not eliminate the risk that someone grabbed it first or that the machine was tampered with. Call your card issuer right away: how much you could owe for any unauthorized charges depends on how fast you report, and the rules differ sharply between debit and credit cards.
What the ATM Does With a Forgotten Card
When you walk away without pulling your card out, the ATM does not leave it sticking out of the slot. After a short idle period, often around 15 to 30 seconds, the machine registers that no one has taken the card and retracts it. The card is routed to an isolated internal compartment sometimes called a capture bin, separate from the cash trays and the card reader path, accessible only to authorized technicians or bank staff.
Captured cards are typically logged and destroyed rather than handed back to the cardholder, even when the ATM sits inside a branch. Network agreements between card issuers and ATM operators generally require destruction to prevent the card from being used again after a potential compromise. Plan on getting a replacement rather than recovering the original.
When It Isn’t a Timeout: Card Trapping
Not every unreturned card is a harmless timeout. Criminals sometimes attach a small device to an ATM’s card slot that deliberately traps your card inside. A hidden camera or a shoulder-surfing accomplice captures your PIN, and after you walk away in frustration, the thief pulls off the device and takes your card with it.
The FBI recommends inspecting any ATM before inserting your card: look for anything loose, crooked, damaged, or scratched around the card slot and keypad, and check for inconsistencies in coloring, material, or shape that might indicate a foreign overlay. If an ATM does not return your card after you cancel or end a transaction, the FBI advises contacting your financial institution immediately, because the failure to return the card may signal that a trapping device is present.1Federal Bureau of Investigation. Skimming Do not re-enter your PIN at the same machine, and ignore any bystander who offers to help by having you try again.
What to Do Right Now
The single most important thing is to contact your card issuer as fast as possible. The speed of your report directly controls how much you could be on the hook for if someone uses the card. Look up the customer service number on your bank’s website, on a second card if you have one, or in your mobile banking app. Do not rely on any phone number posted on the ATM itself, since scammers sometimes place stickers with fake numbers.
Many banking apps include a card freeze or lock toggle that instantly blocks all transactions on the card. Flipping it stops point-of-sale purchases and ATM withdrawals while you sort out the situation, and it doesn’t close the account or cancel the card permanently. Think of it as a temporary block you can turn on in seconds while you make the formal loss report.
When you call the bank, have your account number and recent transaction history ready. The representative will verify your identity, deactivate the card, and start the replacement process. The FTC recommends following up your phone call with a written notice that includes your account number, the date and time you noticed the card was missing, and when you first reported the loss.2Federal Trade Commission. Lost or Stolen Credit, ATM, and Debit Cards
What You Could Owe for Unauthorized Charges
Once you notify the bank, you owe nothing for any unauthorized charges that happen after the report.2Federal Trade Commission. Lost or Stolen Credit, ATM, and Debit Cards The liability rules apply only to charges that occurred before notification, and they work very differently depending on the type of card.
Debit Cards
The Electronic Fund Transfer Act creates three tiers of consumer liability based on how quickly you report.2Federal Trade Commission. Lost or Stolen Credit, ATM, and Debit Cards
- Report within two business days of learning about the loss, and your maximum liability for unauthorized transfers is $50.3Office of the Law Revision Counsel. 15 USC Chapter 41 Subchapter VI – Electronic Fund Transfers
- Report more than two business days after learning of the loss but within 60 calendar days after your statement is sent, and your liability rises to $500 for the unauthorized transfers that occur after the two-day window closes.3Office of the Law Revision Counsel. 15 USC Chapter 41 Subchapter VI – Electronic Fund Transfers
- Wait more than 60 days after the statement is sent, and you can face unlimited liability for transfers the bank can show would not have happened if you had reported sooner. That can include everything in the account and money in linked accounts.4eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
The two-business-day window is the one that matters most. Miss it and your exposure jumps from $50 to $500 overnight.
Credit Cards
If the card you left in the ATM was a credit card, the rules are much more protective. Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50, with no escalating tiers based on reporting speed.5Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card The $50 cap applies only to charges made before you notify the issuer; after that, you owe nothing.
The statute also puts the burden of proof on the issuer, not on you. The issuer has to show that a charge was authorized or that the conditions for the $50 liability have been met.5Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major credit card networks go further with voluntary zero-liability policies that waive even the $50, though those policies are set by the issuer rather than required by federal law.
Getting a Replacement Card
Once you report the card missing, the bank permanently deactivates it and issues a new card with a different number and security code. Even if the ATM sits inside a branch, staff generally will not pull a captured card back out of the machine. The old card is destroyed as a security precaution.
A standard replacement typically arrives by mail within five to ten business days. Most large banks do not charge a fee for standard delivery, though some charge a small fee in the range of $5 to $8. If you need the card sooner, many banks offer expedited shipping for an additional fee that can run anywhere from $5 to $30 depending on the speed. When the new card arrives, you have to activate it through the bank’s app, website, or an automated phone line before it will work.
Accessing Cash While You Wait
A week or more without a card does not have to leave you stuck. Several major banks, including Chase, Wells Fargo, Capital One, and Bank of America, support cardless ATM withdrawals at their machines. These transactions typically work in one of three ways: scanning a QR code on the ATM screen with your banking app, tapping your phone or smartwatch against the ATM using a digital wallet like Apple Pay or Google Pay, or entering a one-time code generated by your banking app.
If your bank does not offer cardless withdrawals, you can visit a branch with a government-issued photo ID and withdraw cash directly from a teller. Some banks also let you send yourself money through peer-to-peer payment services linked to your checking account.
Updating Recurring Payments
A new card number means every subscription and automatic payment tied to the old card will eventually fail, and missed payments can trigger late fees or service interruptions. Some card networks run automated update services, such as Visa Account Updater, that share your new card details with participating merchants behind the scenes, so certain recurring charges transition without any action on your part.
Not every merchant participates, so don’t count on a seamless handoff. Review your recent statements for recurring charges — streaming services, gym memberships, insurance premiums, loan autopayments, utility bills — and update each merchant with the new number as soon as the replacement arrives. Handle first any payment where a missed due date carries a late fee or could affect your credit report.