Last updated 19 October 2026.
Lose your wallet at home and it is a nuisance. Lose it abroad, with your phone in the same bag, and it can cut you off from your money entirely: no card to pay with, no banking app to freeze anything, no phone to receive the text code your bank wants before it lets you in from a new device. If you live between countries, that is not a holiday mishap, it is a gap in how your money is set up. This guide is about closing that gap before you need to: what the law says you are liable for if a card is used after it goes missing, how to arrange cards, phones and sign-in methods so no single loss locks you out, and a step-by-step for the first hour after it happens.
This is general information, not legal or security advice. Card terms and bank processes vary, and the rules quoted below were checked on 19 October 2026.
This piece sits in the Protect section. It pairs with Emergency cash when ISA and FSCS do not apply (how much to keep and where) and Wise is the rail, not your emergency fund (why your transfer account and your safety net should be different things).
The short version
- Your legal liability for a lost or stolen card is usually small if you report quickly: up to £35 in the UK, up to EUR 50 under the EU rules, and up to $50 for US credit cards. US debit cards are the exception that rewards speed most.
- The bigger risk is being locked out, not the fraud itself. One wallet and one phone often hold every card and every sign-in code.
- Split your access across at least two of everything: two cards from different providers, kept apart; two ways to sign in to each important account; and a way to reach your bank that does not depend on the phone you just lost.
- Write the plan down and keep a copy somewhere you can reach from a borrowed device.
What you are liable for if a card is misused
Each of these rules has conditions, so read them as the outline, not the last word.
| Where your card provider is | Most you can usually be asked to pay | Key conditions |
|---|---|---|
| United Kingdom (Payment Services Regulations 2017, regulation 77) | £35 | Nothing after you notify the provider; nothing if the loss was not detectable before the payment; all losses if you acted fraudulently or, with intent or gross negligence, failed to keep the card and security details safe |
| European Union (Directive (EU) 2015/2366, Article 74) | EUR 50 | Similar structure: no liability where the loss was not detectable; full liability for fraud or gross negligence; recital 71 says users should bear no further losses after notifying the provider |
| United States, debit cards (CFPB summary of federal law) | $50 if you report within 2 business days of discovering the loss; up to $500 after that | Report unauthorised withdrawals within 60 days of the statement being sent, or you could be liable for later transactions in full |
| United States, credit cards (CFPB) | $0 if reported before it is used; at most $50 if used before you report it | Many cardholder agreements go further and charge nothing; if only the number is stolen, you generally have no liability |
Sources: legislation.gov.uk (PSRs 2017 reg 77); EUR-Lex (Directive 2015/2366); Consumer Financial Protection Bureau, all checked 19 October 2026.
Two practical lessons follow. First, report fast: in each system, notification is the point after which your exposure shrinks or ends, and for US debit cards the two-business-day window is the difference between $50 and $500. Second, keep your PIN away from the card: the UK and EU rules make you liable for everything if you were grossly negligent, and the EU directive’s own example of gross negligence is keeping the credentials “beside the payment instrument in a format that is open and easily detectable by third parties”.
The CFPB adds a detail that matters when you are away for a long time: in unusual circumstances such as lengthy travel or a stay in hospital, the US notification periods must be extended.
Why a lost phone is now worse than a lost card
A card is one way to pay. A phone is often the way you prove who you are: the banking app, the authenticator app, the number your bank texts codes to, and the email inbox you would use to reset everything else. Lose it and you may not be able to freeze the card that went with it.
The UK’s National Cyber Security Centre recommends two-step verification for important accounts, and is clear that any second step is better than none. It also recommends having a backup plan in case you lose access to your usual second step, noting that many services let you set up more than one option for this reason, and that backup codes “can be used even if you lose your phone”. Each backup code works only once, so you need to create more when you have used them, and they need to be stored somewhere safe.
If you live abroad, there is an extra wrinkle: the number your bank sends codes to may be a home-country SIM you only use for that purpose. If that SIM is in the stolen phone, getting a replacement from abroad can take time.
Building a two-of-everything setup
1. Two cards, two providers, two places
A second card on the same account helps if the first is damaged, but not if the account itself is frozen or the provider’s systems are down. The more robust setup is a second card from a different provider, linked to a different pot of money, carried separately: one in your wallet, one in a bag, a hotel safe or at home.
Some providers also offer digital cards that live only in an app or mobile wallet. Wise, for example, says on its help pages that you can hold up to 3 digital cards at any time in addition to a physical card, and delete and replace them up to 3 times a day. A digital card will not help if the phone is the thing you lost, but it does mean that losing the physical card does not stop you paying from another device you are signed in on.
If you already use Wise to move money between countries, its card can be the “second provider” card alongside your main bank’s, as long as you remember our earlier point: it is a payment tool, not where your emergency fund should live.
Bankrolled may earn a commission if you sign up through this link. It does not change the product or price.
2. Two ways to sign in to each money account
- Where a service offers it, add a second sign-in method alongside the phone: an authenticator on a second device, a hardware security key, or backup codes.
- Print or write down backup codes and keep them with your passport documents at home, not in the wallet you travel with.
- Keep one trusted device (a laptop or tablet) signed in to your main banking and email, stored separately from your phone.
- Check, now, what your bank does if you lose the phone that receives its codes. Some let you verify by phone call or card reader; some require a branch visit. Better to know before you are 2,000 km from the branch.
3. A way to reach your bank without your phone
- Note the overseas contact number for each card provider (usually on the back of the card and on its website) on paper and in a place you can reach from someone else’s device.
- Know how to freeze each card from the web, not only from the app. Wise’s help pages, for example, describe freezing a card from the Card tab, and note that pending and offline transactions still go through after a freeze.
4. Documents and cash
- Keep a scan of your passport and cards (front only, never the security code) in secure cloud storage you can open from a borrowed device.
- Carry a small amount of local cash separately from your main wallet.
- If you are British and your passport goes too: GOV.UK says an emergency travel document costs £125, is usually ready to collect 2 working days after you apply, and can be paid for by a relative or friend if you have lost your wallet. Your old passport is usually cancelled once you pay. Do not book travel until you are told how and when to collect it.
Checklist: your access-redundancy plan
| Item | What good looks like | Done? |
|---|---|---|
| Second card | Different provider, different pot of money, carried separately | |
| Card contact numbers | Overseas numbers written down, away from the wallet | |
| Freeze method | You know how to freeze each card from the web, as well as the app | |
| Backup sign-in | Backup codes or a second method on bank, email and payment accounts | |
| Trusted device | A second signed-in device stored apart from your phone | |
| Code-receiving SIM | You know what your bank does if that number is lost, and how to replace the SIM from abroad | |
| Document copies | Passport and card fronts in secure storage you can reach from any device | |
| Emergency cash | Some local cash, plus an emergency fund you can reach from a second provider |
The first hour after a loss
- Freeze or cancel every card that was lost. Use a trusted device or a borrowed one, or call the provider. Freezing is quick and reversible; Wise, for example, says a frozen card cannot be used for new payments or ATM withdrawals, and recurring payments will be declined.
- Remember what freezing does not stop. Wise’s help page notes that pending and offline transactions will still be processed: a payment authorised before you froze the card can still go through. Check recent transactions once you are back in.
- Replace cards that are definitely gone. Freezing is temporary. For a stolen card, a replacement cancels the old one.
- Secure the phone accounts. If the phone went too, sign it out of your accounts from another device where you can, change your email password first (it is the key to resetting everything else), and contact your mobile network about the SIM.
- Report unrecognised transactions to each provider straight away, in writing if asked. The CFPB notes a US bank can ask for written confirmation and may not have to give a temporary credit if you do not follow up in time.
- Report the theft locally if your insurer or bank asks for a police reference.
- Use the second card to keep going while replacements arrive.
Illustrative: one bag, two outcomes
Illustrative. Alex lives in Lisbon and has a bag stolen at a café. In it: a UK debit card, a US credit card, a phone and the PIN for the debit card written on a slip of paper in the same purse.
Without a plan. The banking apps are on the stolen phone. Alex’s UK bank sends codes to a UK SIM that was in the phone. It takes until the next morning, from a hotel computer, to find the right overseas numbers and freeze both cards. Two cash withdrawals were made with the PIN. Because the PIN was kept with the card, the UK bank may argue gross negligence, which under regulation 77 can leave Alex liable for the full amount rather than £35. Alex has no other card and borrows money from a friend for three days.
With a plan. Alex carries a second card from a different provider in a jacket pocket, keeps the PIN in memory only, and has a tablet at home signed in to both banks and email. Within the hour, using the café owner’s laptop and a written list of numbers, Alex freezes both cards and changes the email password. The US credit card had been used once before the freeze: under the CFPB’s summary, the most Alex can owe is $50. Alex pays for the taxi home with the second card.
The theft was the same. The setup decided the outcome.
FAQ
Is my liability the same if my card is from a bank in another country?
Not necessarily. The UK regulations and the EU directive each cover payment services provided in their own area, so what matters is generally where your card provider is based and regulated, rather than where you were when the card went missing. Your card terms will say which rules apply.
Should I freeze or cancel?
Freeze first if you think the card might turn up; it is quick and reversible. If it has been stolen, or you see payments you do not recognise, replace it, which cancels the old card.
What if I cannot get into my bank account at all?
Call the provider’s overseas number. Many card providers can freeze or cancel a card over the phone; check how yours handles it before you travel. This is why the numbers belong on paper and not only in your phone.
Are backup codes safe to write down?
The NCSC says to store them somewhere safe. Keeping them at home with important documents, rather than in the wallet you carry, means one theft cannot take both.
Does a mobile wallet on my phone count as a second card?
Not for this purpose. If the phone is lost, so is the mobile wallet. The second card should not depend on the same device or bag as the first.
What this article is not
It is not a full guide to every country’s card rules, insurance cover for stolen belongings, or identity theft recovery. It does not cover business cards, which can have different liability terms. Liability limits have conditions and exceptions; your provider’s terms and the regulations themselves are the final word. The example is fictional.
Sources
- legislation.gov.uk: Payment Services Regulations 2017, regulation 77. £35 maximum for lost, stolen or misappropriated payment instruments; exceptions; no liability after notification; full liability for fraud or intentional or grossly negligent breach. Last checked 19 October 2026.
- EUR-Lex: Directive (EU) 2015/2366 (PSD2). Article 74 (EUR 50 maximum; exceptions; fraud and gross negligence); recital 71 (no further losses after notification); recital 72 (gross negligence example). Last checked 19 October 2026.
- Consumer Financial Protection Bureau: Getting money back after an unauthorised transaction. Debit card: $50 within 2 business days, up to $500 after; 60-day statement rule; extensions for lengthy travel or hospitalisation; written confirmation and temporary credit. Last checked 19 October 2026.
- Consumer Financial Protection Bureau: Unauthorised charges on lost or stolen credit cards (last modified 22 January 2025). $0 if reported before use; at most $50 otherwise; no liability if only the number is stolen. Last checked 19 October 2026.
- National Cyber Security Centre: Setting up 2-Step Verification. Any 2SV better than none; backup plan; backup codes work once and can be used if you lose your phone. Last checked 19 October 2026.
- Wise Help Centre: How do I freeze or unfreeze my Wise card? Freezing blocks new payments, ATM withdrawals and recurring payments; pending and offline transactions still processed; replacing cancels the old card. Last checked 19 October 2026.
- Wise Help Centre: Getting started with your Wise digital card. Up to 3 digital cards plus a physical card; delete and replace up to 3 times a day; availability by country. Last checked 19 October 2026.
- GOV.UK: Travel urgently from abroad without your UK passport, how to apply. £125 fee, no refund; usually ready 2 working days after applying; a relative or friend can pay; old passport usually cancelled. Last checked 19 October 2026.
- Bankrolled: Emergency cash when ISA and FSCS do not apply.
- Bankrolled: Wise is the rail, not your emergency fund.
Still got a question? Ask Bankrolled and get a quick answer from our guides.
