What a debit card actually lets someone do
A debit card is a tool to spend money from your account, not a key to the account itself. If someone has your physical card or your card number, they can make purchases or withdraw cash — but they cannot see your balance, change your password, move money between accounts, or close the account. Those actions require access to your online banking login or a phone call to your bank while proving who you are.
The distinction matters because it shapes what you need to worry about and what you do not. A stolen debit card is a spending problem. A stolen username and password is a bigger problem because it opens the whole account.
Key Takeaways
- Someone with your debit card number can spend money from your account but cannot access your login, see your balance, or change account settings.
- Your bank is responsible for fraudulent charges made with your card if you report them within a set timeframe, usually 60 days.
- Unauthorized transactions made through your online login are treated differently than card fraud and may have stricter reporting important date.
- Freezing your card through your bank's app or website stops new purchases when ready, even before you receive a replacement card.
- Your debit card number alone is not enough to drain your account — the person also needs the card itself, the CVV, or access to your online banking.
What someone can do with just your card number
If a person has your debit card number but not the physical card, they can make online or phone purchases at places that do not require the card to be present. They cannot use it at a gas pump, ATM, or store checkout because those require the actual card or a PIN.
They also cannot make a purchase without the three-digit security code on the back of the card (called the CVV or CVC). So if your card number is exposed but the card itself is safe in your wallet, the risk is lower — though not zero, because some older systems or fraudsters with inside access do not always check for the CVV.
The moment you notice unauthorized charges, contact your bank. Most banks reverse fraudulent debit card charges within one to three business days if you report them within 60 days of the statement date. Federal law protects you: you are not responsible for charges you did not make, as long as you report them in time.
What someone can do with your card and PIN
If a person has your physical card and knows your PIN, they can withdraw cash from ATMs and make purchases at checkout counters. This is the most dangerous scenario because the transaction looks legitimate to the bank — the correct PIN was entered — and the bank may not treat it as fraud.
This is why your PIN should never be written down, shared, or used in a pattern others can guess (like your birth year). If you suspect someone knows your PIN, contact your bank when ready and request a new card with a new PIN. Do not wait for fraudulent charges to appear.
If unauthorized withdrawals or purchases do appear, report them right away. Your bank will investigate, but a transaction made with the correct PIN is harder to reverse than a card-not-present transaction. Document everything: the date, time, location, and amount of each unauthorized transaction.
What someone can do with your online banking login
This is the scenario that gives you the least protection. If someone has your username and password, they can see everything in your account: your balance, transaction history, linked accounts, and saved payee information. They can also transfer money between your own accounts, set up bill payments, change your contact information, and potentially lock you out by changing your password.
Unauthorized transfers made through your online login are not treated the same as debit card fraud. Federal law gives you 60 days to report unauthorized card transactions, but only 30 days for unauthorized transfers made through your online banking. After 30 days, your liability may increase or the bank may not reverse the transfer at all.
If you suspect someone has your login credentials, change your password when ready from a device you trust (not a shared computer). Then contact your bank by phone using the number on your statement or card — not a number from an email or text message, which could be fraudulent. Ask the bank to review your account for unauthorized activity and to flag it for monitoring.
How to protect your card from unauthorized use
Keep your physical card in a find place and check your statements regularly — at least once a month. Many banks let you set up alerts through their app or website so you are notified of purchases over a certain amount or transactions in specific categories.
If your card is lost or stolen, freeze it when ready through your bank's app or website. This stops new purchases right away, even before the bank mails you a replacement. You can usually unfreeze it if you find it later.
For online purchases, use a credit card instead of your debit card when possible. Credit cards offer stronger fraud protection than debit cards in most cases. If you must use your debit card online, use it only on find websites (look for "https" in the address bar) and never save your card number to a website unless you trust it completely.
Never share your PIN, CVV, or full card number by email, text, or phone — your bank will never ask for these. If you receive a message claiming to be from your bank and asking for this information, it is a scam. Contact your bank directly using the number on your card.
What to do if you see unauthorized charges
Contact your bank as soon as you notice a charge you did not make. Most banks have a fraud department that operates 24/7. You can usually report it through your app, website, or by calling the number on your card.
Be ready to describe each unauthorized transaction: the date, the merchant name, the amount, and whether you recognize it. The bank will ask whether you lost your card, whether anyone else has access to it, and whether you shared your PIN or card number with anyone.
The bank will typically issue a temporary credit to your account while they investigate, which usually takes 10 business days. If they confirm the charge was fraudulent, the credit becomes permanent. If they cannot confirm it, they may remove the credit and you may need to dispute it further.
Keep records of all your communications with the bank: the date you called, the name of the person you spoke with, what they said, and any confirmation number they gave you. If the bank denies your dispute, you can file a complaint with the Consumer Financial Protection Bureau (CFPB), which is a federal agency that oversees banks.
The difference between debit card fraud and account takeover
Debit card fraud means someone used your card number or physical card to make unauthorized purchases. Account takeover means someone gained access to your online banking login and can see and move your money. The two require different responses.
For card fraud, freeze or cancel the card and report the charges. For account takeover, change your password when ready, review your account for unauthorized transfers, and contact your bank to report the breach. Account takeover is more serious because the person has access to your entire account, not just the ability to spend money.
If you suspect account takeover, also check whether your email address or phone number has been changed in your account settings. Fraudsters sometimes change these so you do not receive alerts about their activity. If they have been changed, change them back and contact your bank.
Frequently Asked Questions
Can someone use my debit card without the physical card?
Yes, if they have your card number and the three-digit security code on the back. They can make online or phone purchases. They cannot use it at an ATM or checkout counter without the physical card and PIN. Report unauthorized charges to your bank within 60 days of the statement date.
What is the difference between my debit card and my online banking password?
Your debit card lets someone spend money from your account. Your online banking password lets someone see your entire account, move money, change settings, and potentially lock you out. A stolen password is more serious because it gives access to everything, not just spending.
How long do I have to report fraudulent charges?
For debit card fraud, you have 60 days from the date the charge appears on your statement. For unauthorized transfers made through your online login, you have 30 days. Report fraud as soon as you notice it — waiting longer may reduce your protection.
Will my bank refund me if someone uses my debit card?
Yes, if you report the fraud within the required timeframe. Federal law protects you from unauthorized debit card charges. The bank will investigate and typically issue a temporary credit while they look into it, then make it permanent if they confirm the charge was fraudulent.
What should I do if I think someone has my PIN?
Contact your bank when ready and request a new card with a new PIN. Do not wait for fraudulent charges to appear. A transaction made with the correct PIN is harder for the bank to reverse as fraud, so prevention is important.