Lost, Stolen, or Damaged Cards

This guide describes the procedure for handling lost, stolen, or damaged cards using the <a href="ref:post_modifystatus" target="_blank">Modify Status</a> and <a href="ref:post_addcard" target="_blank">Add Card</a> endpoints, which you implement from your own web site or mobile app. 
Alternatively, your customers can use Galileo's <<glossary:IVR>>, or you can report cards as lost, stolen, or damaged using the <<glossary:CST>>. Contact Galileo for information on using these methods.
See the <a href="doc:setting-up-a-card-program" target="_blank">Setting Up a Card Program</a> guide for general information about cards in the Galileo system.
Note
Instead of reporting a card as lost or stolen, your customers might want to temporarily freeze a card. See <a href="doc:card-statuses#freezing-cards" target="_blank">Freezing cards</a> in the _Card Statuses_ guide for more information.
## Lost or stolen cards
A card is "lost" when the cardholder no longer possesses the card but does not suspect that someone else has the card or will attempt to use it—for example, when a wallet falls into a lake. However, out of an abundance of caution, a replacement card with a new <<glossary:PAN>> should be issued for a lost card. 
A card is "stolen" when someone has taken possession of a card or card number with the intent to use it fraudulently. A physical card may be stolen in a robbery, or a card number may be obtained online from a database breach or intercepted transmission. In the case of stolen cards a replacement card with a new PAN should always be issued.
Note
The lost and stolen operations are identical in the Galileo system—the lost and stolen distinction is intended for your records only.
You have two options for lost/stolen cards:
Mark the card as lost or stolen and at the same time trigger the operation to issue a replacement physical card.
Use the <a href="ref:post_modifystatus" target="_blank">Modify Status</a> endpoint with `type: 3` for lost or `type: 4` for stolen.
Do not use this method for virtual-only cards.
Mark the card as lost or stolen but do not issue a replacement card.
Use the Modify Status endpoint with `type: 8` for lost or `type: 9` for stolen.
Always use this method for virtual-only cards.
To trigger the card-replacement operation after passing these Modify Status types, you can pass types `3` or `4` later.
Note
For Digital First cards, see <a href="doc:setup-for-digital-first#lost-or-stolen-digital-first-cards" target="_blank">Lost or stolen Digital First cards</a> in the _Setup for Digital First_ guide.
### Lost/stolen physical card operation
This operation issues a replacement physical card as soon as a card is reported as lost or stolen.
The cardholder reports the card as lost or stolen.
You call the <a href="ref:post_modifystatus" target="_blank">Modify Status</a> endpoint with these parameters:
`accountNo:`  PAN or CAD of the card
`type: 3` for lost or `4` for stolen
The lost/stolen card operation:
Changes the card to `status: L` or `status: S`, which immediately deactivates the card.
Sends the <a href="ref:api-reference-events-api-lost-stolen-card-with-replacement" target="_blank">`LSCR: lost/stolen card with replacement`</a> event message.
Creates a new card record in `status: A` with the same PRN but a new <<glossary:PAN>>, <<glossary:CVV>> and <<glossary:expiry date>>. 
Waits for any replacement fees to be processed, and then changes the card status:
`X` — Set to emboss, for conventional cards
`N` — Active, for <<glossary:Digital First>> cards (see <a href="doc:setup-for-digital-first#lost-or-stolen-digital-first-cards" target="_blank">Lost or stolen Digital First cards</a> in the _Setup for Digital First_ guide for additional steps you must take)
When the emboss process runs, it creates an emboss record in `status: Y`, includes the emboss record in the batch file, and sends the <a href="ref:api-reference-events-api-card-shipped" target="_blank">`SHIP: card_shipped`</a> event message.
The embosser mails the replacement card to the cardholder. 
The cardholder activates the card using your preferred method, which changes the replacement card to `status: N`. See the <a href="doc:activate-card-procedure" target="_blank">Activating a Card</a> guide for more information. 
Because the replacement card has a different PAN from the lost/stolen card, the cardholder must set a new PIN. See <a href="doc:pin-set-procedures" target="_blank">PIN-Set Procedures</a> for more information.
The lost/stolen card retains `status: L` or `status: S`.
Tip
Because the lost/stolen card operation creates the replacement card in `status: A`, and then changes it to `status: X` or `status: N`, you can populate the CDMSG parameter with `X` or `N`, and then the status change will trigger the <a href="ref:api-reference-events-api-card-status-change" target="_blank">`CSNT: card_status_change`</a> event message. From that message you can retrieve the PAN or CAD of the replacement card within minutes, instead of waiting several hours for the emboss process to send `SHIP: card_shipped`.
### Lost/stolen virtual card operation
This operation does not issue a replacement card.
The cardholder reports the card as lost or stolen.
You call the <a href="ref:post_modifystatus" target="_blank">Modify Status</a> endpoint with these parameters:
`accountNo:` PAN or CAD of the card
`type: 8` for lost or `9` for stolen
The lost/stolen card operation:
Changes the card to `status: L` or `status: S`, which immediately deactivates the card
Sends the <a href="ref:api-reference-events-api-lost-stolen-card-no-replacement" target="_blank">`LSCN: lost/stolen card no replacement`</a> event message.
You call the <a href="ref:post_addcard" target="_blank">Add Card</a> endpoint with these parameters to receive the new PAN, CVV, and expiry date:
`accountNo:`  PAN or PRN of the lost/stolen card
`newAccountNo:`  Do not populate
`prodId:`  Must be the same as the lost/stolen card 
If the product settings do not automatically activate the card upon creation (such as with Digital First), call the Modify Status endpoint with these parameters:
`accountNo:`  PAN or CAD of the added card
`type: 7` 
The lost/stolen card retains `status: L` or `status: S`.
Note
If a lost or stolen card was in a mobile wallet, the replacement card does not automatically replace the card in the wallet. Either the cardholder must manually provision the replacement card to the wallet or you push-provision  it. See <a href="doc:mobile-wallets#manual-provisioning" target="_blank">Manual provisioning</a> or <a href="doc:mobile-wallets#push-provisioning" target="_blank">Push provisioning</a> in the _Setup for Mobile Wallets_ guide for instructions.
## Damaged cards
A "damaged" card is still in the cardholder's possession, but it cannot be used in card readers because of physical damage to the card.
A damaged card should be reissued rather than replaced. See the <a href="doc:reissuing-cards" target="_blank">Reissuing Cards</a> guide for instructions.
## Temporarily issue cards
While customers wait for the personalized, physical card to arrive in the mail, your program might offer the option of issuing an instant-issue (physical) or virtual card in the meantime. When the cardholder activates the personalized card, the temporary card is deactivated.
For temporary instant-issue cards, follow the instructions in <a href="doc:instant-issue-cards#adding-an-instant-issue-card-to-an-existing-user" target="_blank">Adding an instant-issue card to an existing user</a> in the _Setup for Instant Issue_ guide.
For temporary virtual cards, call the <a href="ref:post_addcard" target="_blank">Add Card</a> endpoint with the PAN or PRN of the card you are replacing as the `accountNo`.
If the card is a <a href="doc:choose-a-card-strategy#digital-first-cards" target="_blank">Digital First card</a>, the new virtual card is already available to use as soon as the old card is reported lost, stolen, or damaged.  However, if the original card was in a mobile wallet, the card in the wallet is not automatically updated. You must push-provision the new card, or the cardholder must input the new card manually.