What a debit card does and does not let someone do

A debit card tied to your savings account lets the holder withdraw cash, make purchases, and check the balance—but it does not give them access to the full account itself. Someone with your physical card or card number cannot transfer money to another account, change your account settings, add authorized users, or see your full transaction history the way an account owner can. They can only spend what they can withdraw or charge at a point of sale.

The distinction matters because it shapes what damage is possible and how you recover from it. If someone uses your debit card without permission, your bank can reverse the charges and return the money. If someone gains access to your actual account—through your online login, by calling the bank posing as you, or by being added as an authorized user—the situation is much harder to undo.

Key Takeaways

  • A debit card holder can spend money but cannot access your account settings, transfer funds between accounts, or see your full history.
  • Someone with your card number can make online purchases and withdrawals, but cannot change your password or add themselves as an owner.
  • Unauthorized debit card charges are reversible through your bank's fraud process, usually within 10 business days.
  • Account access (login, phone verification, authorized user status) is a separate and more serious breach than card misuse.
  • Freezing your card immediately stops new charges; reporting fraud to your bank starts the reversal process.

What someone can do with your physical debit card

If someone has your card in hand, they can withdraw cash from any ATM up to your daily limit, make in-person purchases at stores, and use the card number for online shopping. They cannot see your account balance without attempting a transaction, and they cannot access your online banking portal or mobile app. The card itself is a spending tool, not a key to your account.

Your daily withdrawal limit—often $500 to $1,000 depending on your bank—caps how much cash they can pull in one day. Purchase limits vary by merchant and card type, but there is no single daily spending cap the way there is for ATM withdrawals. Someone could theoretically make multiple large purchases in a single day if your card has no fraud detection in place.

What someone cannot do with just your card number

A person with your debit card number alone cannot log into your online account, change your password, transfer money to their own account, or set up bill pay. They cannot add themselves as an authorized user or joint owner. They cannot see your full transaction history or account statements. Online banking requires a username and password; phone banking requires identity verification (usually your Social Security number, date of birth, and answers to security questions).

This is why card fraud is treated differently from account takeover. Card fraud is a spending problem; account takeover is an identity problem. If someone calls your bank claiming to be you and convinces them to change the password or add a new owner, that is account takeover, and it is much harder to reverse because the bank treated the request as legitimate.

How someone might gain actual account access

Account access requires one of these routes: your online login credentials (username and password), successful identity verification over the phone, or being added as an authorized user by someone who already has account access. A thief with your debit card alone cannot do any of these things. They would need additional information—your email address, your Social Security number, answers to your security questions, or access to your email account itself.

Phishing is the most common entry point. A fake email or text claiming to be from your bank asks you to "verify your account" or "confirm your identity" and directs you to a fake website that looks like your bank's login page. If you enter your username and password there, the thief now has them. From that point, they can log in, see everything, and move money freely.

The second route is social engineering: calling your bank, claiming to be you, and providing enough personal information to pass verification. Banks ask for name, address, date of birth, and sometimes the last four digits of your Social Security number or answers to security questions you set up. If a thief has gathered this information from a data breach, a stolen wallet, or public records, they may be able to convince a bank representative to reset your password or confirm a wire transfer.

Steps to take if your debit card is lost or stolen

Call your bank immediately—most have a 24-hour fraud line on the back of your card or on your statement. Tell them the card is lost or stolen and ask them to freeze or cancel it. This stops any new charges within minutes. Do not wait to see if charges appear; the sooner you report it, the sooner the card is useless to anyone else.

Your bank will send you a replacement card, usually within 5 to 10 business days. In the meantime, ask if they can issue a temporary card number for online purchases or provide a way to access cash—some banks offer emergency cash advances or temporary digital wallet access. Check your account for any unauthorized charges and report each one to your bank's fraud department. Charges made before you reported the card lost are your bank's responsibility to reverse under federal law (Regulation E), though the process typically takes 10 business days.

Steps to take if you suspect account access has been compromised

If you notice transactions you did not make, changes to your password, new authorized users you did not add, or a sudden inability to log in, contact your bank immediately by phone—do not use the number in an email or text, as those may be fake. Use the number on your card or statement. Tell them you suspect account fraud or unauthorized access.

Your bank will freeze the account, review recent activity, and reverse any fraudulent transfers. They will also ask you to change your password and may require you to verify your identity in person at a branch. If money was transferred out, your bank is responsible for returning it under federal law, though the investigation can take 30 to 60 days. In the meantime, ask your bank to place a fraud alert on your credit file and consider a credit freeze to prevent someone from opening new accounts in your name.

How to protect your debit card and account

For your card: keep it in a secure location, do not share the number over email or text, and monitor your statements weekly for charges you do not recognize. Set up transaction alerts through your bank's app so you are notified of any withdrawal or purchase over a certain amount—$1 or $5 is a common threshold. This catches fraud quickly.

For your account: use a strong, unique password (at least 12 characters, mixing letters, numbers, and symbols), enable two-factor authentication if your bank offers it, and do not reuse passwords across different websites. Do not answer security questions with information that is publicly available (your mother's maiden name is often in public records; a made-up answer is safer). Do not click links in emails or texts claiming to be from your bank; instead, log in directly through the bank's website or app. Shred documents with your account number before throwing them away.

Frequently Asked Questions

Can someone use my debit card if they only know the number?

Yes, they can make online purchases and potentially withdraw cash if they also know your PIN. They cannot access your account or see your balance without attempting a transaction. Report the card number to your bank immediately so they can cancel it and issue a replacement.

What if someone has my debit card and my PIN?

They can withdraw cash up to your daily limit and make purchases. Freeze the card right away by calling your bank. Any charges made before you reported it are reversed by the bank under federal law, though the process takes about 10 business days.

Can a debit card holder change my password or add themselves to my account?

No. A debit card is a spending tool only. Changing passwords or adding authorized users requires access to your online account or successful identity verification over the phone. These are separate from card access and require different information.

How long does it take to get my money back after debit card fraud?

Your bank must return the money within 10 business days if you reported the fraud within 60 days of the statement date. If you wait longer to report it, the timeline extends to 45 days. Keep records of when you reported the fraud and which transactions you disputed.

Should I close my savings account if my debit card was stolen?

Not necessarily. Freezing the card stops new charges immediately. Close the account only if you suspect someone has accessed your online login or if your bank recommends it after investigating. A new account means new account numbers for direct deposit and bill pay, which is inconvenient but sometimes necessary.