What a debit card holder can actually do with your account
A person with your debit card can spend the money in your checking or savings account up to your available balance, but they cannot access your full account — they cannot change your password, see your transaction history, move money between accounts, or set up new cards or transfers. What they can do is limited to what the physical card allows: make purchases at stores and online, withdraw cash at ATMs, and pay bills if they have the card number and expiration date.
The key difference is between card access and account access. Your debit card is a tool to spend money you already have. Your bank account itself — the login, the settings, the full history — stays protected by your username and password. Someone holding your card cannot log into your online banking, cannot see your balance before they use it, and cannot drain your account beyond what the card will allow at that moment.
That said, if someone has your card, they can spend your money quickly. A debit card has no spending limit built in — only your available balance stops them. And unlike a credit card, where fraud is often caught before you pay, debit card fraud comes straight from your account. You have to notice it and report it to get the money back.
Key Takeaways
- A debit card holder can spend money from your account but cannot log in, change passwords, or access account settings.
- They can make purchases and withdraw cash up to your available balance, with no built-in spending limit on the card itself.
- Debit card fraud hits your account immediately, unlike credit card fraud, so money is gone until you report it and the bank investigates.
- Your bank's fraud protection and your own monitoring are your main defenses — report unauthorized charges within 60 days to preserve your right to a refund.
How much damage someone can do with your card number alone
If someone has only your card number, expiration date, and CVV (the three-digit code on the back), they can make online and phone purchases but cannot withdraw cash from an ATM or use it in person. Online retailers often do not ask for your PIN, so a stolen card number is enough to buy things. Some merchants ask for a billing address or ZIP code, which adds a small barrier but not a reliable one.
The damage is still real but narrower than if they have the physical card. They cannot drain your account in one visit to an ATM. They can only spend what merchants will accept without a PIN. And online fraud is often easier for banks to reverse because there is a clear record of the transaction and the merchant's address.
Why a physical card in someone else's hands is riskier
If someone has the actual card, they can use it at ATMs to withdraw cash, which leaves less of a trail than online purchases. They can also use it at gas pumps, vending machines, and self-checkout lanes where no one checks ID. A card number alone cannot do this — they need the physical card or a clone of it.
ATM withdrawals are particularly dangerous because the money is gone instantly and there is no merchant record to help trace it. A person with your card can also test it at small purchases first to see if it is still active, then move to larger amounts. By the time you notice, they may have already taken several hundred dollars.
Physical card theft is also harder to dispute. When you report it, the bank knows the card was used at specific locations and times. You have to prove you were not there, which is easier if you have a solid alibi but harder if you cannot account for every hour.
What happens to your account if someone uses your card without permission
The money comes out of your account immediately, just as if you had spent it yourself. Your available balance drops right away. If you overdraft — if the fraudulent charges push you below zero — you may face overdraft fees on top of the stolen amount.
You do not lose the money permanently, but you have to report it to get it back. Your bank will investigate, and if they confirm the charges were unauthorized, they will refund you. The timeline varies: some banks refund within a few business days, others take up to 10 business days. During that time, the money is gone from your account and you cannot spend it.
If the fraud is extensive — multiple transactions, large amounts, or a pattern over time — the investigation can take longer. The bank may freeze your account temporarily while they look into it, which means you cannot access your money even though it is technically still yours.
How to protect yourself if someone has your card information
If you know or suspect someone has your debit card or card number, contact your bank immediately. Do not wait to see if charges appear. Most banks let you report fraud by phone, online, or in person at a branch. Ask them to cancel the card and issue a replacement. This stops anyone from using that card number going forward.
Report any unauthorized charges within 60 days of the statement date. This is the legal deadline to preserve your right to a refund under federal law. After 60 days, the bank may refuse to refund you, even if the charges were clearly fraudulent. Write down the date and time you reported it, the name of the person you spoke to, and what they told you.
While the investigation is underway, keep using your account normally if you can. Your bank will usually issue a temporary card or let you use online banking. Do not close the account — that can complicate the investigation. Once the bank confirms the fraud, they will refund the money and you can move on.
Signs that someone is using your card without permission
Check your bank statements and transaction history regularly — at least weekly if possible. Look for charges you do not recognize, especially small ones. Fraudsters often test stolen cards with small purchases first, so a $1.99 or $4.50 charge from an unfamiliar merchant can be the first sign.
ATM withdrawals from locations you did not visit are another red flag. If your statement shows a $200 withdrawal from an ATM across town or in another state, and you know you did not make it, that is fraud. The same goes for online purchases from merchants you have never heard of or in countries you have never visited.
Some fraud is obvious — large charges from stores you do not shop at or subscriptions you did not sign up for. Other fraud is subtle. A charge labeled "ONLINE PURCHASE" with no merchant name is worth investigating. Call your bank and ask what that charge is. They can tell you the merchant and the location, and you can decide if it was you.
What your bank's fraud protection covers
Federal law limits your liability for unauthorized debit card charges, but the limit depends on how quickly you report it. If you report the card lost or stolen before any fraudulent charges appear, you are not liable for anything. If you report it within two business days of discovering unauthorized charges, you are liable for no more than $50. If you wait more than two business days but less than 60 days, you could be liable for up to $500. After 60 days, you may not be covered at all.
Your bank may offer additional fraud protection beyond what the law requires. Some banks refund all fraudulent charges regardless of when you report them, or they offer zero-liability policies. Check your account agreement or call your bank to find out what they cover. Do not assume you are protected — know the actual policy.
Fraud protection does not prevent the charges from hitting your account in the first place. It only means you can get the money back after you report it. During the investigation, the money is still gone from your available balance, which can cause problems if you have bills due or need cash.
Frequently Asked Questions
Can someone access my online banking if they have my debit card?
No. Your debit card is separate from your online banking login. They would need your username and password to access your account online. Having the card does not give them those credentials. However, if they also have access to your email, they might be able to reset your password and lock you out of your account.
What if someone cloned my debit card?
A cloned card works the same way as a stolen card — the person can make purchases and withdraw cash up to your available balance. Report it to your bank immediately, the same as you would a lost or stolen card. The bank will cancel both the original and the clone, and you will get a new card. Cloning is harder to prevent, but monitoring your statements closely helps you catch it early.
Can I get my money back if I report fraud after 60 days?
Probably not, under federal law. The 60-day window is a legal deadline, and banks are not required to refund charges reported after that date. Some banks may refund you anyway as a courtesy, but you have no legal right to it. Report fraud as soon as you notice it — do not wait.
Will my bank refund me while they investigate?
Not automatically. Some banks issue a provisional credit while they investigate, which means you can use the money temporarily. Others make you wait until the investigation is complete. Ask your bank what their policy is when you report the fraud. If they do not offer a provisional credit, ask if they can make an exception given the circumstances.
What if the fraudster used my card at a store and I have video proof I was not there?
Video proof helps, but it is not required. The bank's job is to determine whether the charge was authorized by you, not to prove who actually made it. If you report the charge as unauthorized and you were clearly somewhere else at the time, the bank will usually refund it without much investigation. Keep any evidence — receipts, timestamps, witness statements — but do not assume you need it. Report it first and let the bank ask for proof if they need it.