Lost, Stolen, or Damaged Cards

This guide describes the procedure for handling lost, stolen, or damaged cards using the Replace Lost/Stolen Card, Modify Status or Add Card endpoints, which you implement from your own web site or mobile app.

Alternatively, you can report cards as lost, stolen, or damaged using the CST.

See the Setting Up a Card Program guide for general information about cards in the Galileo system.

Modify Status vs. Replace Lost/Stolen Card

The legacy method of reporting a physical card as lost or stolen and to order a replacement is to use the Modify Status endpoint with type: 3 (lost) or type: 4 (stolen). This method initiates the card-replacement process, but it does not return the replacement card's PAN, CVV, or expiry date; those values are generated later by the emboss process, which runs once per day for most programs.

The Replace Lost/Stolen Card endpoint, however, returns the replacement card values immediately. This endpoint also handles fees a little differently. Instead of checking the pend value for the REP fee, it leaves cards in status: A (lost/stolen card waiting for sufficient funds) until there are sufficient funds for the fee, but it does not assess a fee if it drives the account negative. (For that, you must use the CST.)

If you want to report a physical card as lost or stolen but do not want to order a replacement at the same time, use Modify Status type: 8 (lost) or type: 9 (stolen), as before.

📘

Note

Instead of reporting a card as lost or stolen, your cardholders might want to temporarily freeze the card. See Freezing cards in the Card Statuses guide for more information.

Lost or stolen cards

A card is "lost" when the cardholder no longer possesses the card but does not suspect that someone else has the card or will attempt to use it—for example, when a wallet falls into a lake. However, out of an abundance of caution, a replacement card with a new PAN should be issued for a lost card.

A card is "stolen" when someone has taken possession of a card or card number with the intent to use it fraudulently. A physical card may be stolen in a robbery, or a card number may be obtained online from a database breach or intercepted transmission. In the case of stolen cards a replacement card with a new PAN should always be issued.

📘

Note

Lost and stolen operations are identical in the Galileo system—the lost and stolen distinction is intended for your records only.

You have these options for lost/stolen cards:

• Mark the card as lost or stolen and at the same time trigger the process to issue a replacement physical card.
  • Use the Replace Lost/Stolen Card endpoint with cardStatus: L for lost or cardStatus: S for stolen.
  • Do not use this method for virtual-only cards.
  • Alternatively, you can use Modify Status type: 3 for lost or type: 4 for stolen. However, this method does not return the new PAN, CVV and expiry date, which are not generated until the emboss process runs, which is usually once per day.
• Mark the card as lost or stolen but do not issue a replacement physical card.
  • Use the Modify Status endpoint with type: 8 for lost or type: 9 for stolen.
  • Always use this method for virtual-only cards.
  • To issue a replacement card later, use the Add Card endpoint.

Replacement fees

For lost or stolen cards the REP (replacement) fee is applied, not the REI (reissue) fee, because lost and stolen cards are always replaced. See Reissuing vs. replacing in the Reissuing Cards guide to learn the difference.

When you configure any fee, you must determine whether the fee should pend or whether it should drive the account negative in the case of insufficient funds:

• Fee set to drive the account negative — (Modify Status only) When the fee is configured to drive the account negative, the fee is immediately assessed and a new emboss record is created and sent to the emboss partner. In this case the new card goes into status: Y (shipped/ready to activate; the card order has been sent to the embosser). Once new funds are added to the account the unpaid replacement card fee is assessed and the remainder of the funds are made available to the card holder.

• Fee not set to drive the account negative — When the fee is not set to drive the account negative (set to pend), the new card will be set to status: A (lost card waiting for sufficient funds), and will not be sent to the emboss partner until there are enough funds in the account to cover the card reissue fee. According to your arrangements with Galileo, you can receive the ISFE: insufficient_funds_to_emboss event message.

  The system will periodically attempt to assess the fee until there are sufficient funds. As soon as there are sufficient funds, the fee is automatically assessed, a new emboss record is created, the card is set to status: Y, and the card order is sent to the emboss partner.

Bypass the replacement fee

If you want to bypass the replacement fee on an individual card, use one of these methods:

• CST — When marking a card as lost or stolen in the Card Info tab, change the card status to either lost or stolen, then select Yes for Bypass card replacement fee(s).
• Program API — When calling Modify Status or Replace Lost/Stolen Card, pass bypassRepFee: Y.

Lost/stolen physical card process

This process issues a replacement physical card as soon as the card is reported lost or stolen.

🚧

Warning

Cards marked as lost/stolen with card replacement can only be marked lost/stolen once and cannot be reactivated.

1. The cardholder reports the card as lost or stolen.
2. You call the Replace Lost/Stolen Card endpoint with these parameters:
   • accountNo: The PRN, PAN or CAD of the card to report as lost or stolen.
   • cardStatus: L for lost or cardStatus: S for stolen
   • bypassRepFee: Optional. Pass Y to bypass any replacement card (REP) fee; if there is no fee, or if you want to assess the fee, pass N or leave blank
   • cardNumberLastFour: Optional. If accountNo contains a PRN, pass the last four digits of the PAN to select the correct card
     • See Replace Lost/Stolen Card Endpoint Workflow for details.
3. The endpoint:
   • Changes the card to status: L or status: S, which immediately deactivates the card.
   • Sends the LSCR: lost/stolen card with replacement event message.
   • Sends the CSNT: card_status_change event message if the new status (L or S) is present in the CDMSG parameter.
   • Assesses the REP fee, as appropriate. See Replace Lost/Stolen Card Endpoint Workflow for information about bypassing the fee. If there are insufficient funds for the fee, Galileo sends the ISFE: insufficient_funds_to_emboss event message.
   • Returns the CAD, PAN, CVV and expiry date for the replacement card.
4. Optional. To specify express shipping for the card, call Set Account Feature with these values:
   • featureType: 5 (enable express shipping)
   • featureValue: Yor 0–9, as specified by your emboss vendor
5. When the emboss process runs, it verifies that all applicable fees have been assessed.
   • If the REP fee or other fees such as MAI (express mail) are still pending, the process waits until the balance is sufficient for the fee(s). Alternatively, you can force-emboss the replacement card in the CST.
   • If all fees are paid, the process changes the card status to Y, creates an emboss record in status: Y, includes the emboss record in a batch file for the embosser, and sends the SHIP: card_shipped event message.
6. The embosser mails the replacement card to the cardholder.
7. The cardholder activates the card using your preferred method, which changes the replacement card and emboss records to status: N. See Card activation in the Setting Up a Card Program guide for more information.
   • Because the replacement card has a different PAN from the lost/stolen card, the cardholder must set a new PIN. See PIN-Set Procedures for more information.
8. When the cardholder sets the new PIN, Galileo sends the PNCH: system_pin_change event message.

Lost/stolen Digital First card process

This process issues a replacement Digital First card as soon as the card is reported as lost or stolen.

🚧

Warning

Cards marked as lost/stolen with card replacement can only be marked lost/stolen once and cannot be reactivated.

1. The cardholder reports the card lost or stolen.
2. You call the Replace Lost/Stolen Card endpoint with these parameters:
   • accountNo: The PRN, PAN or CAD of the card to report as lost or stolen.
   • cardStatus: L for lost or cardStatus: S for stolen
   • bypassRepFee: Optional. Pass Y to bypass any replacement card (REP) fee; if there is no fee, or if you want to assess the fee, pass N or leave blank
   • cardNumberLastFour: Optional. If accountNo contains a PRN, pass the last four digits of the PAN to select the correct card
   • See Replace Lost/Stolen Card Endpoint Workflow for details.
3. The endpoint:
   • Changes the card to status: L or status: S, which immediately deactivates the card.
   • Sends the LSCR: lost/stolen card with replacement event message.
   • Sends the CSNT: card_status_change event message if the new status (L or S) is present in the CDMSG parameter.
   • Assesses the REP fee, as appropriate. See Replace Lost/Stolen Card Endpoint Workflow for information about bypassing the fee. If there are insufficient funds for the fee, Galileo sends the ISFE: insufficient_funds_to_emboss event message.
   • Returns the CAD, PAN, CVV and expiry date for the replacement card.
4. You call the Set Account Feature endpoint to protect the physical card in transit. See Protecting the physical card in Setup for Digital First for the settings.
5. If the digital version of the card is in a mobile wallet, the card is not automatically updated. You must push-provision the new card, or the cardholder must input the new card manually.
6. Optional. To specify express shipping for the card, call Set Account Feature with these values:
   • featureType: 5 (enable express shipping)
   • featureValue: Y or 0–9, as specified by your emboss vendor
7. When the emboss process runs, it verifies that all applicable fees have been assessed.
   • If the REP fee or other fees such as MAI (express mail) are still pending, the process sends the ISFE: insufficient_funds_to_emboss event message, and the emboss process pauses until the fees are paid. See Pending fees in the About Fees guide for more information.
   • If all fees are paid, the process creates an emboss record in status: Y, includes the emboss record in a batch file for the embosser, and sends the SHIP: card_shipped event message.
8. The embosser mails the replacement card to the cardholder. Because the replacement card has a different PAN from the lost/stolen card, the cardholder must set a new PIN. See PIN-Set Procedures for more information.
9. When the cardholder sets the new PIN, Galileo sends the PNCH: system_pin_change event message. When you get the event message, call the Set Account Feature endpoint again to remove the protection.

Lost/stolen virtual card process

This process does not automatically issue a replacement card. You can use this method for physical cards when you do not want to issue a replacement card at the same time.

1. The cardholder reports the card as lost or stolen.
2. You call the Modify Status endpoint with these parameters:
   • accountNo: The PRN, PAN or CAD of the card to report as lost or stolen.
   • cardNumberLastFour: Optional. If accountNo contains a PRN, pass the last four digits of the PAN to select the correct card
   • type: 8 for lost or 9 for stolen
3. The lost/stolen card process:
   • Changes the card to status: L or status: S, which immediately deactivates the card
   • Sends the LSCN: lost/stolen card no replacement event message.
   • Sends the CSNT: card_status_change event message if the new status (L or S) is present in the CDMSG parameter.
4. Virtual card only. You call the Add Card endpoint with these parameters:
   • accountNo: PAN or PRN of the lost/stolen card.
   • newAccountNo: Do not populate
   • prodId: Must be the same as the lost/stolen card
5. The Add Card endpoint automatically activates the card upon creation and returns the new CAD (card_id).

📘

Note

If a lost or stolen card was in a mobile wallet, the replacement card does not automatically replace the card in the wallet. Either the cardholder must manually provision the replacement card to the wallet or you push-provision it. See Manual provisioning or Push provisioning in the Setup for Mobile Wallets guide for instructions.

Damaged cards

A "damaged" card is still in the cardholder's possession, but it cannot be used in card readers because of physical damage to the card.

A damaged card should be reissued rather than replaced. See the Reissuing Cards guide for instructions. For damaged Digital First cards, see Reissuing Digital First cards in the Setup for Digital First guide.

Events API

You can arrange with Galileo to receive these events related to lost and stolen cards, according to your use case.