Crypto Card Lost or Stolen 2026: Freeze, Then Wait
- Notification is the event, not the deadline. Regulation 77(4)(a) of the UK PSRs 2017 and Article 74(3) of PSD2 both end liability for anything that happens after you notify. Neither sets an hour count: regulation 72(1)(b) asks only for “without undue delay”.
- Seven of twelve readable programmes let you freeze the card yourself. Two let you report it without a human. KAST and MetaMask Card make an email address the only channel.
- Visa's zero-liability rule has a carve-out written for this market. Core Rule 1.4.5.1 excludes “Anonymous Prepaid Card Transactions” from the duty to limit liability to zero on notification.
- The emergency replacement bank customers get does not reach prepaid cards. Table 4-5 sets a 24-hour standard; Table 4-6 excludes Visa Prepaid Cards. Crypto.com's fee schedule: “Expediting a Card replacement is not available.”
- Plutus publishes the only hard deadline — 24 hours — and no clause at all on replacing the card. All eight instances of “replacement” in its 13,597-word EEA terms are about gift cards.
On this page
- Notification is the only moment that matters
- The Visa carve-out written for this market
- Freeze and report are two different buttons
- Crypto card lost or stolen, programme by programme
- The channel is the latency
- The 24-hour clock one programme invented
- What the scheme guarantees after the report
- The new card has a new number
- A self-custodial card loses a key, not a balance
- Five minutes, in order
- Final take
- Sources
- FAQ
The worst time to find out how your card programme handles a theft is while standing on a pavement without the card. A crypto card lost or stolen costs you nothing in law for anything after you report it, and everything before that depends on how fast the programme lets you speak. So on 25 October 2026 we read fifteen programmes' own documents alongside the UK regulations, the EU directive and the public Visa rulebook. Twelve published something readable: seven publish a way to freeze the card yourself, two let you file the report without a support agent, and four publish no procedure at all.
Notification is the only moment that matters
Almost every consumer guide here organises itself around a deadline, because that is how a bank card works: report within two days and you are covered, dawdle and you are not. The instruments governing cards in this market are built the other way round. They care about the act of notification.
Regulation 72(1)(b) of the UK Payment Services Regulations 2017 asks only that you “notify the payment service provider in the agreed manner and without undue delay on becoming aware of the loss”. Then regulation 77 does the work: paragraph (1) lets the provider make you liable “up to a maximum of £35”, and paragraph (4)(a) removes even that for losses “arising after notification under regulation 72(1)(b)”. Article 74(3) of Directive (EU) 2015/2366 is the same rule in EU drafting: after notification the payer “shall not bear any financial consequences resulting from use of the lost, stolen or misappropriated payment instrument”.
A card scheme adds a third layer. Visa Core Rule 1.4.5.1, in the 18 April 2026 edition of the public rulebook, says “an Issuer must limit a Cardholder's liability to zero upon notification from the Cardholder of an unauthorized Transaction”. Same hinge, different authority — and it binds the issuer whatever country it sits in, which matters where the issuer is rarely the brand on the card.
| Layer | Instrument | Cap before you notify | After you notify | What voids it |
|---|---|---|---|---|
| UK statute | PSRs 2017, reg. 77(1) and 77(4)(a) | £35 | Nil — losses “arising after notification” | Fraud, or failing reg. 72 “with intent or gross negligence” (reg. 77(3)) |
| EU statute | PSD2, Art. 74(1) and 74(3) | EUR 50 | Nil — “no financial consequences” | Fraud; intent or gross negligence against Art. 69 |
| Card scheme | Visa Core Rules 1.4.5.1 (ID# 0029460) | Issuer's choice | Zero — “must limit… to zero upon notification” | Corporate, Purchasing and Anonymous Prepaid transactions; proven fraud or negligence |
| Contract (US) | Crypto.com Prepaid Visa agreement, § 26 | $50 inside two business days; $500 outside it | Tied to telling the bank “AT ONCE” | Nothing recoverable past 60 days |
| Contract (offshore) | KAST agreement, § 7.3 | No cap stated | Nil — after “receipt of your notice by us” | Use before the notice is read |
Four drafters, one shape. Which is why the only number worth optimising is the gap between noticing and notifying — and why a programme that routes the notice through an inbox has made that gap its business rather than yours.
The Visa carve-out written for this market
Before leaning on the scheme rule, read its exclusions, because one of them describes this entire product category. Rule 1.4.5.1 lists three transaction types to which the zero-liability duty does not apply: “Visa Corporate Card Transactions”, “Visa Purchasing Card Transactions” and “Anonymous Prepaid Card Transactions”.
For a bank cardholder that third line is irrelevant, which is why nobody writing about lost cards mentions it. For a reader of this site it is the point: a card obtained without identity verification, loaded from a wallet and spent anonymously is the thing the exclusion names. Where it bites, the scheme backstop is gone and you have whichever statute your issuer's authorisation drags in, plus the contract.
Freeze and report are two different buttons
People use the words interchangeably and the programmes do not. A freeze is a spending switch: instant, reversible and legally inert. A report is the notification the statutes are built around: permanent, and the thing that caps your exposure. Gnosis Pay's help centre is the only document in our set that states both halves and the cost of confusing them. On freezing: “Freezing blocks all payments instantly and you can undo it whenever you like, as often as you like”. On reporting: “Reporting a card lost or stolen cancels it permanently”, so “only report it if you're confident it's gone for good”. That advice is unimprovable, which makes it odd that it exists on one help centre out of fifteen.
The order is what the law rewards. Freeze first, because it costs nothing if the card is behind the sofa. Then report anyway, because the freeze is not notification and regulation 77(4)(a) does not know the button exists. A cardholder who freezes and stops has protected the card and not themselves.
Crypto card lost or stolen, programme by programme
Fifteen programmes, read on 25 October 2026 from cardholder agreements, product disclosure statements, terms and help centres. Twelve published something readable: Gemini answered with a Cloudflare challenge, RedotPay returned 403, and Bybit's card terms article has now failed on three reads across nine days. The columns are deliberately narrow — can you stop the card yourself, can you file the notice yourself, and what does a new one cost.
| Programme | Self-freeze published? | Self-report published? | Replacement fee |
|---|---|---|---|
| Crypto.com | Yes — Card page, More, Freeze Card | No — support contact required | $50, or $7 on Midnight Blue |
| OKX | Yes — “you can do this yourself at any time” | Self-lock counts as notice (cl. 15(a)(i)) | Nil — “no fee for Card reissuance” |
| Gnosis Pay | Yes — reversible, instant | Yes — cancels permanently | 4.99 EURe / GBPe / USDCe |
| Kraken | Yes — card icon, Freeze card | Yes — Get help, Replace card, It's lost | Not published |
| Plutus | Yes — deactivate in the Dashboard | Dashboard, plus notice within 24 hours | Not stated |
| MetaMask Card | Yes — freeze on the dashboard | No — email to Crypto Life | Not published |
| Bitget Wallet Card | Yes — Manage Card, Freeze Card | No — support or card@bitget.com | Not published |
| KAST | Not published | No — email only | Not stated; § 6 allows one |
| Nexo, Bleap, Wirex, XKard | Not published (Nexo markets “instant card freezes” without a procedure) | Not published | Not published |
The last row is blank on every column, and these are not small programmes. Bleap's help centre carries a twelve-article Bleap Card collection — PIN activation, virtual cards, declines, wallet balances, chargebacks — and not one is about losing the card. Wirex lists eleven Wirex Card articles across four sub-sections, with a Security category covering phishing and scams. Neither names a lost card.
XKard is this site's hero affiliate and the worst result in the set. Its terms, last updated 4 June 2025 and operated by XHYPE FZCO, run to seven numbered sections and contain zero instances of “lost” and zero of “stolen”; section 2 says only that “users must comply with the terms set by the issuing providers”. The programme that pays us tells its cardholders nothing about this.
The channel is the latency
If notification is the hinge, the channel is its speed, and it varies more than any other feature here. Visa's rules describe what a cardholder is supposed to have: under 4.1.12.2 the issuer must give every cardholder “a telephone number that is available worldwide 24 hours a day, 7 days a week, for reporting lost, stolen or compromised Cards”. Table 4-6 then makes “Lost/Stolen Card Reporting” a service the issuer must provide for “All Cards” — the only line in that table with no product exclusions at all.
| Reporting channel | Programmes | What the document says |
|---|---|---|
| Published phone line | Crypto.com, OKX | 1-888-824-8817; +61 2 8880 0709, “and leaving a voicemail” |
| Phone, once you log in | Gemini | The 24/7 number sits inside Card Settings in the Help Center |
| In-app chat | OKX, Crypto.com, Gnosis Pay, Bitget Wallet | “available 24/7” (OKX); chat then identity check (Gnosis Pay) |
| Email only | KAST, MetaMask Card | support@kastcard.com; an obfuscated address for Crypto Life |
| Self-service, no human | Gnosis Pay, Kraken, Plutus | Report in card settings; Replace card; deactivate in the dashboard |
| Nothing published | Bleap, Wirex, XKard, Nexo | No lost-card article, clause or contact route found |
Two of twelve make an inbox the only route, and one obscures the address: MetaMask's support page serves the reporting email through Cloudflare's obfuscation, so a reader without JavaScript sees the literal string “[email protected]” where the channel should be. It resolves to metamask@cl-cards.com.
KAST's is the sharpest case, because its contract and its channel point opposite ways. Section 7.3 gives the cardholder the strongest clause in the set — “you will not be liable for any unauthorized use that occurs after you notify us” — then requires you to “notify us promptly by emailing us at support@kastcard.com”, with liability running until “receipt of your notice by us”. So the moment that ends your exposure is the moment an inbox is read, no response time is published, and the agreement offers no way to freeze the card meanwhile.
The 24-hour clock one programme invented
Only one document in the set puts a number on the notification duty. Section 10.6 of the Plutus EEA terms — last updated 8 April 2025, issued by Block Code LT UAB of Vilnius for consumers in Lithuania and the EEA — reads: “If your Plutus Card is lost or stolen, you immediately deactivate your card via the Plutus Dashboard and notify us within 24 hours of becoming aware of the loss or theft. Failure to do so within this period may result in increased liability for any unauthorised transactions.”
As practical advice it is fine. As a contract term it sits awkwardly against the directive it operates under. Article 69 of PSD2 requires notification “without undue delay”, not inside a fixed window, and Article 74(1) raises the cap above EUR 50 only for fraud or a failure of those obligations “with intent or gross negligence”. Reporting at hour thirty rather than hour twenty is not obviously either.
Plutus also has the most conspicuous hole in the set. Its EEA terms run to 13,597 words, and “replacement” and its variants appear eight times — all eight about gift cards, in sections 25.11 to 25.14. There is no clause anywhere about replacing the payment card you just reported lost.
What the scheme guarantees after the report
Here the comparison with a bank card breaks, and it breaks in the rulebook rather than in anybody's customer service. Visa does run an emergency replacement standard and it is strict: 4.1.12.1 requires an issuer to “approve or deny” a request “within 2 hours of notification”, Table 4-5 sets delivery, and 4.1.12.2 forbids “additional charges to the Cardholder if a service or timeframe is required for the Card type”, with four excuses only.
| Visa rule | Card inside the issuing region | Card outside it | Applies to a prepaid crypto card? |
|---|---|---|---|
| Lost/Stolen Card Reporting (Table 4-6) | Required | Required | Yes — “All Cards”, no exclusions |
| Emergency Card Replacement, all other products (Table 4-5) | Within 24 hours of approval | Within 1 business day | No — Table 4-6 excludes “Visa Prepaid Cards” |
| Issuer response to an emergency request (4.1.12.1) | Approve or deny within 2 hours | Approve or deny within 2 hours | Only once the service itself applies |
Read the right-hand column. Table 4-6 excludes Visa Prepaid Cards from Emergency Card Replacement, with a narrow exception for Platinum Prepaid in the Asia-Pacific and CEMEA regions. Crypto.com's card is, in its own agreement's title, the “CRYPTO.COM Prepaid Visa® Card” — so the starkest line in its fee schedule, an “Expedited replacement card” row reading “Not available” across all seven tiers, is not a programme being unhelpful. It is the scheme's prepaid carve-out showing up on a price list.
What survives the carve-out is the reporting line. “All Cards”, no exclusions, is the strongest phrase available to a cardholder here, and it covers one thing: the right to tell somebody. The speed, the courier and the fee are the programme's commercial choice.
The new card has a new number
One sentence in the KAST agreement explains most of the inconvenience of a lost card, and it is a sentence no competitor page carries. Section 7.1: replacement cards “may have new account numbers”, so the cardholder must update anything holding the old details.
That is the real bill. Not the $50 and not the courier, but every stored credential keyed to a sixteen-digit number that no longer exists — the streaming subscription, the exchange account you top up by card, the checkout profile at the shop you use weekly. The schemes run account-updater services for exactly this, but a programme has to be enrolled, and not one of the twelve documents mentions it either way.
Gnosis Pay publishes the only bridge across the gap: on a replacement request, “you may be eligible for an instant virtual card while the physical card is in transit”. That is the right design, because a virtual card is issued in software and needs no courier — which is why it is the thing to ask for before you ask when the plastic arrives.
A self-custodial card loses a key, not a balance
The custody model changes what a theft is, and the market splits cleanly. On a custodial card the programme holds the money, so a stolen card is a route into a balance somebody else controls and your protection is the liability rule. On a self-custodial card the money never left your wallet, so the card is a revocable permission and the exposure is bounded by that permission rather than the balance.
MetaMask's support page puts it carefully: the wallet and the card are “separate entities”, linked only through a spending limit, so the card cannot reach past the cap. It treats the two failures separately — a compromised wallet is a wallet problem, a stolen card is a card problem.
So a self-custodial cardholder has a lever nobody else has, and it works before the theft. The spending cap is the liability cap: set to the week's groceries rather than the wallet's contents, it converts an unbounded loss into a bounded one with no statute, scheme rule or support agent involved — the same spending limits we catalogued, used defensively.
Five minutes, in order
- Freeze it in the app. Seconds, reversible, and it stops the bleeding while you work out whether the card is gone. If your programme publishes no toggle, skip straight to step two rather than hunting for one.
- Send the notification, by the channel the document names. This is the step that caps your liability, and the freeze does not do it for you. Keep the timestamp, because regulation 77(4)(a) turns on it.
- Read the transaction list before you close the app. Anything unrecognised is a separate claim on its own clock: 60 days from the statement under the Crypto.com agreement, 13 months from the debit date under the PSRs.
- Ask for a virtual card, then ask about the plastic. A virtual replacement is software and can be instant; the physical one is a courier with no published standard behind it.
- List what held the old number. Subscriptions, wallet top-ups, stored checkouts — replacement cards “may have new account numbers”.
Check the freeze button before you need it
Kardd reads what each programme publishes — fees, custody, issuer, limits and the clauses behind them — so you can tell which cards have a procedure written down and which have a chat widget.
Kardd may earn a commission on sign-ups, including XKard. Affiliate disclosure.
Final take
Every layer of rule-making here agrees on where the line sits. The UK regulations, the EU directive, the Visa rulebook and four cardholder contracts all stop liability at the moment of notification. None of them says how quickly you must be allowed to notify, and that is the gap this audit measures.
So the feature to shop for is not the replacement fee. It is the freeze toggle and a reporting channel with a human behind it. On that test Gnosis Pay and Kraken are clearest: both take a cardholder from loss to a replacement order without a support ticket, and Gnosis Pay alone explains what reporting costs you if you are wrong. Which is a strange result, because Gnosis Pay stops issuing replacements on 20 December 2026 and warns that one ordered in late November may not arrive first. For the second audit running, the best-documented procedure in this market belongs to a card being switched off.
Sources
All read on 25 October 2026. Payment Services Regulations 2017, reg. 77 and reg. 72; Directive (EU) 2015/2366, Article 74; Visa Core Rules and Visa Product and Service Rules, 18 April 2026 edition — 1.4.5.1 (ID# 0029460), 4.1.12.1 (ID# 0002627), 4.1.12.2 (ID# 0002626), 4.1.12.4 (ID# 0004081), Table 4-5 and Table 4-6; CRYPTO.COM Prepaid Visa Cardholder Agreement, effective 1 September 2026 (§§ 24–26, fee schedule), and its prepaid card help article on lost and damaged cards (5 December 2025); OKX Card Product Disclosure Statement, 9 June 2026, issuer Bano Pty Limited AFSL 536984 (cl. 15–17); KAST Cardholder Agreement (Non-US), 20 March 2025 (§§ 4, 7.1–7.3, 8); Plutus EEA Terms & Conditions, updated 8 April 2025 (§ 10.6, §§ 25.11–25.14); Gnosis Pay, “Card problems”; MetaMask Card security and privacy; “Managing Your Bitget Card (Asia Pacific)”, published 25 March 2026; Kraken, “How to Report and Freeze a Lost Kraken Card”; Bleap Card help collection (12 articles, none on loss); Wirex Card help category (11, none on loss); Nexo Card page; XKard terms, 4 June 2025. Gemini and RedotPay refused the request; Bybit's card terms article failed for the third time in nine days.
Related Articles
- Crypto Card Chargebacks 2026: What You Can Actually Dispute
- Crypto Card Issuers 2026: 16 Programmes Checked
- Crypto Card Issuance Fees 2026: $0 to $125
- Crypto Card Data Retention 2026: Five to Ten Years
- Crypto Card Shutdowns 2026: 90 Days or No Notice
- Gnosis Pay Shutting Down 2026: What Cardholders Must Do
Frequently Asked Questions
What should I do first if my crypto card is lost or stolen?
Freeze it in the app, then report through whatever channel the programme names. The freeze is reversible and instant; the report is the legal event. Regulation 77(4)(a) removes liability for losses “arising after notification”, and Article 74(3) of PSD2 says the payer bears “no financial consequences” for use after it.
How long do I have to report a lost crypto card?
The statutes set no hour count — regulation 72(1)(b) asks for notice “without undue delay on becoming aware of the loss”. One programme publishes a number: Plutus requires notice “within 24 hours” under section 10.6. In the US, Crypto.com ties its $50 tier to telling the bank within two business days.
Am I liable for transactions made after my crypto card was stolen?
Before you report: up to £35 under reg. 77(1), or EUR 50 under Article 74(1), unless you were fraudulent or grossly negligent. After you report: nothing, under both. Visa Core Rule 1.4.5.1 adds that an issuer “must limit a Cardholder's liability to zero upon notification”, subject to the exclusions below.
Does Visa's Zero Liability rule cover an anonymous prepaid crypto card?
Not on the rule's own wording. Rule 1.4.5.1 excludes “Visa Corporate Card Transactions”, “Visa Purchasing Card Transactions” and “Anonymous Prepaid Card Transactions”. That last category is the product this market sells, so where it applies only your issuer's jurisdiction and contract remain.
How fast will a crypto card be replaced after it is reported lost?
Nothing in our set promises a date. Table 4-5 sets a 24-hour emergency replacement standard, but Table 4-6 excludes “Visa Prepaid Cards” from the service, and most crypto cards are prepaid. Crypto.com's fee schedule: “Expediting a Card replacement is not available.”
What happens if a self-custodial crypto card is stolen?
The thief gets a spending route, not your balance. MetaMask describes the card and the wallet as “separate entities” linked only by a spending allowance, so the card cannot reach past the cap you set — which makes that cap the one number you can change before anything goes wrong.