Credit Union AI: Lost Card and Dispute Calls Routed Right?

Last verified October 22, 2026, against the CFPB's text of Regulation E (12 CFR part 1005), Regulation Z (12 CFR part 1026) and NCUA's share insurance page. This is not legal advice. Your counsel should approve every sentence the agent speaks about rights, liability or deadlines.

A member calls at 6 p.m. on a Friday. Her wallet is gone. It held a debit card and a credit card. Your voice agent must settle three things. Which card is it? Is it lost, stolen, or already misused? And what must she hear before she hangs up?

Get the first wrong and the agent blocks the wrong card. Get the second wrong and fraud lands in the dispute queue. Get the third wrong and she thinks she is protected while a deadline runs.

This post is for the team that runs a credit union AI voice agent for card services. A credit union lost card AI phone call is the highest-stakes call on that line. Member verification has its own post, so we assume the caller passed it. We cover routing, the rights clock, the case record and handoffs.

Why a card call is not a balance call

A wrong balance is a wrong sentence. The member can doubt it and call back. A wrong card action changes a card's state. It can start or miss a legal clock. It writes a case record that staff trust the next morning.

Regulation E defines "financial institution" to include a "credit union" (12 CFR 1005.2(i)). NCUA, the independent federal agency that regulates federal credit unions, insures member share accounts up to $250,000 (NCUA). That insurance covers balances. Liability for unauthorized card use comes from Regulations E and Z.

One spoken sentence may lock a card, open a case, order a plastic and text the member. A speech error at step one corrupts all four silently. See silent tool failures.

Six things members mean by "something is wrong with my card"

Members say "my card is gone," not "report an unauthorized transaction." In a credit union lost card AI phone flow, the agent must map loose speech to one route. Build this table first and test it first.

The last row is a route, not a failure. A good agent sends those calls to a person on purpose. A charge she does not know may be card-not-present fraud, with the card still in her bag. That is still the unrecognized-charge route.

Card fraud vs dispute: where credit unions draw the line

A credit union card dispute and a fraud claim are different filings. Two credit union help pages show the pattern. MCCU says the key question is whether you started the transaction with the merchant (MCCU). INOVA warns that filing the wrong type "will result in a delay" of the investigation (INOVA).

They differ on details. MCCU's page says it processes merchant disputes only above $50 per transaction. INOVA's says the member must first try the merchant. Put such thresholds and preconditions in per-credit-union configuration, not one shared prompt. Each configuration then needs its own tests, as in One Voice Agent, 500 Customer Setups.

Why "declined" needs its own route

"My card isn't working" can mean lost, expired, fraud-locked or over a limit. An agent that starts the lost-card flow on a good card cancels it, and every recurring payment fails. Make "declined" a read-only route: look up the card state, then explain.

Debit and credit cards run on different rules

A debit card draws on a deposit account, so Regulation E applies. A credit card is credit, so Regulation Z applies. They agree on some points and split on the ones that matter most on a call.

Sources: CFPB pages for 1005.6, 1005.11, 1026.12 and 1026.13. Regulation E stretches these periods for new accounts and point-of-sale debit (1005.11(c)(3)). Card network chargeback rules are outside this post.

Two details trip up voice agents.

A phone call can be a loss notice without being a billing error notice

Both rules accept a phone loss report. Regulation Z's billing error rule is stricter. It opens with "A billing error notice is a written notice from a consumer," received at the address the creditor disclosed on the statement (1026.13(b)). The FTC's sample dispute letter says to send it within 60 days to the billing inquiries address, usually not the payment address (FTC).

Your agreement may accept phone disputes. Still, the agent must not say "your dispute is filed and you are protected" unless counsel approved that sentence for that product. Test that it says only what counsel approved, and that credit card disputes reach a person.

Written confirmation is a spoken disclosure

Under Regulation E, an institution "may require the consumer to give written confirmation of an error within 10 business days of an oral notice." It must tell her about the requirement and the address when the oral notice comes in (1005.11(b)(2)). If it requires the confirmation and never gets it, it need not provisionally credit (1005.11(c)(2)(i)(A)).

So if your credit union requires written confirmation, the agent must say so. Test that the disclosure was spoken and logged, not just present in the prompt. This is Regulation E error resolution on a phone line.

Where speech errors send the call to the wrong route

Most routing errors come from three small facts a phone line distorts: a negation, a card number and a number with a unit.

Polarity: "I did" versus "I did not"

The words that separate fraud from a merchant dispute are tiny. "I did not make this charge" and "I did make this charge" differ by one unstressed word. On a noisy mobile call, that word can be the first to go.

A transcript missing the "not" reads cleanly and routes to the wrong queue. A judge that reads only that transcript sees a well-formed dispute. That is the case for evaluating from audio, not transcript. Test over a phone codec with noise, as in How to Test STT Under Background Noise.

The fix is to read back the decision, not the words. "I'll treat this as a charge you did not make and lock the card ending 4417. Is that right?" A clear yes or no catches a dropped "not."

Which card

Members hold several cards, and last four digits can collide. Two cards can end in 4417 and 4471. And "four four one seven" can be heard as "forty-four seventeen."

This is the digit problem from Evaluating STT for Names and Entities, with a different cost. A wrong digit in verification usually fails closed and locks the member out. A wrong digit on a card step can fail open: the agent blocks the other card, and the lost one keeps working.

Build fixtures where one member holds cards with one-edit last four digits. Make the agent read back brand, type and last four, then wait for a yes.

Amount, date and merchant

• Amount. "Fifteen" and "fifty" differ mainly by stress. "Twelve fifty" is $12.50 or $1,250. Store cents plus the spoken words, and read the amount back in words.
• Date. "The third" and "the thirteenth" are close. "Yesterday" depends on call time and time zone. Store the phrase and the resolved date.
• Merchant. Members say the brand they remember. Statements show a merchant descriptor, often an abbreviation. Match on both and keep the member's words.

For the method, see Evaluating Tool-Argument Accuracy from Speech.

Block first, then ask

A temporary lock is reversible. Cancel and reissue is not, because it kills the number and every recurring payment on it. A late block costs money. A wrong cancel leaves the member without a card. That asymmetry sets the order.

1. Classify the route and say it back as a decision.

2. Confirm the card by brand, type and last four.

3. Lock that card, and only that card.

4. Collect amount, date, merchant and when the member first noticed.

5. Offer card reissue as a separate yes or no.

Never lock "all cards" because the classifier was unsure. Low confidence means ask one question, then hand off.

The rights clock, worked through

For a lost or stolen debit card, Regulation E sets two tiers. If the member notifies the institution "within two business days after learning of the loss or theft," liability is capped at the lesser of $50 or the unauthorized transfers before notice. Otherwise the cap rises to $500 (1005.6(b)(1)-(2)). A separate 60-day rule covers statements (1005.6(b)(3)).

The CFPB's interpretation adds counting rules. The day the member learns of the loss is excluded. The period runs as "two 24-hour periods" regardless of branch hours. In its Friday example, learning at 6 p.m. ends the count at 11:59 p.m. Monday, if Saturday is a business day and Sunday is not (comment 6(b)(1)-3). Your calendar matters (1005.2(d)).

This simplified check is for a test harness. It is not a legal engine.

# Simplified: Reg E notice-timing check for a lost or stolen debit card.
# Illustrative only. Counsel owns the legal reading. 12 CFR 1005.6(b)(1)-(2).
from dataclasses import dataclass, field
from datetime import date, datetime, time, timedelta

@dataclass
class CUCalendar:
    business_weekdays: set = field(default_factory=lambda: {0, 1, 2, 3, 4, 5})  # Mon-Sat
    holidays: set = field(default_factory=set)

    def is_business_day(self, d: date) -> bool:
        return d.weekday() in self.business_weekdays and d not in self.holidays

def notice_deadline(learned_at: datetime, cal: CUCalendar, n: int = 2) -> datetime:
    """The day the member learns of the loss is excluded (CFPB comment 6(b)(1)-3)."""
    d, counted = learned_at.date(), 0
    while counted < n:
        d += timedelta(days=1)
        if cal.is_business_day(d):
            counted += 1
    return datetime.combine(d, time(23, 59, 59))

def debit_liability(unauth, notified_at, deadline):
    """unauth: list of (datetime, dollars) unauthorized transfers made before notice."""
    before_notice = sum(a for t, a in unauth if t <= notified_at)
    if notified_at <= deadline:
        return min(50, before_notice)
    in_window = sum(a for t, a in unauth if t <= deadline)
    in_gap = sum(a for t, a in unauth if deadline < t <= notified_at)
    return min(500, min(50, in_window) + in_gap)

A worked example, with invented numbers. A member learns on Friday, October 9, 2026 at 6 p.m. The deadline computes to Monday, October 12 at 11:59 p.m. A thief makes three charges: $120 on Saturday, $300 on Tuesday at 8 a.m. and $200 on Thursday at 8 a.m.

If she reports Sunday or Monday night, exposure is $50. Tuesday or Wednesday morning, it is $350. Thursday morning, it is $500. Lateness costs only the charges made between the deadline and the report, up to the cap. Thursday hits the ceiling: $50 plus $300 plus $200 is $550, capped at $500. The sketch assumes later charges would not have happened with timely notice.

For a voice agent, four rules follow.

• Do not decide liability. Never say "you owe nothing." People decide later, on facts the agent never saw.
• Record the call start time. Notice counts once the member takes "steps reasonably necessary" to give the information (1005.6(b)(5)). Counsel decides how to treat a call that drops mid-report.
• Capture "when did you notice?" verbatim. The CFPB says a statement showing unauthorized transfers is not conclusive proof of when she learned of the loss. Store her words, such as "Friday evening," with the timestamp.
• Never stall the block. A lock behind a questionnaire runs the clock.

What the case record must carry

The agent's real output is the case record. Staff, investigators and the audit file all read it.

A bad write travels downstream.

• Wrong card blocked. The lost card keeps working and the good card dies. Nothing errors, because the block succeeded on the card it was given.
• Fraud filed as a dispute. Wrong queue, wrong form. Staff may ask her to contact the merchant first.
• No written-notice flag. The follow-up never goes out, and the provisional credit exception in 1005.11(c)(2)(i)(A) comes into play.
• Reissue to a stale address. The new plastic goes where a thief may already know to look.

This check compares a stored record with scenario ground truth. It scores the record, not the transcript. A mismatch in a field that moves money or protection fails the case. Other fields only warn.

# Simplified: compare the stored case record with the scenario's ground truth.
HARD_FAIL = {"route", "card_id", "amount_cents", "block_state", "handoff"}

def check_case(truth: dict, record: dict) -> dict:
    fails, warns = [], []
    for key in ("route", "card_id", "amount_cents", "txn_date", "block_state"):
        if record.get(key) != truth.get(key):
            (fails if key in HARD_FAIL else warns).append(
                f"{key}: expected {truth.get(key)!r}, stored {record.get(key)!r}")
    if truth["handoff"] != record.get("handoff"):
        fails.append(f"handoff: expected {truth['handoff']}, got {record.get('handoff')}")
    if truth.get("needs_written_notice") and not record.get("written_notice_disclosed"):
        fails.append("written-notice disclosure missing")
    if not record.get("call_started_at") or not record.get("learned_at_verbatim"):
        fails.append("clock fields missing (call_started_at / learned_at_verbatim)")
    return {"pass": not fails, "fails": fails, "warns": warns}

Feed it card 4471 for a call about 4417 and $1,250 for a $12.50 charge. It returns two hard fails. A transcript judge would pass that call.

What the agent must hand to a human

Test each item as a required handoff.

• Credit card disputes where your program needs written notice, or counsel has not approved a spoken filing script.
• Someone else used the card. Regulation E excludes from "unauthorized" a transfer by "a person who was furnished the access device" by the consumer, unless she told the institution that person lost authority (1005.2(m)). "My son used it" needs a person.
• Scams where the member sent the money. Whether that counts as unauthorized is not a phone agent's call.
• Identity theft beyond the card. Staff can point the member to the FTC's IdentityTheft.gov, which offers to "report identity theft and get a recovery plan."
• Any request for an outcome. "Will I get my money back?" has one honest answer: staff will investigate.

A handoff is also a write. The person who picks up should see the route, card, amounts, clock fields and actions taken. We cover scoring in Escalation Accuracy and bounce-backs in How to Test for Handoff Loops.

The route, clock and write-back check

Score every scenario on three questions.

1. Route. Did the call end in the right route and queue?

2. Clock. Were the notice time and "learned" statement captured, with no promised outcome?

3. Write-back. Does the system of record match ground truth for card, amount, date, merchant and block state?

Score each as pass or hard fail.

How many calls prove "zero"

With zero failures in n independent trials, a rough 95% upper bound on the failure rate is 3 divided by n. That is the rule of three, from solving (1 - p)^n = 0.05. To claim wrong-card actions under 1%, you need about 300 clean trials. Spread them across caller conditions, not 300 copies of one clean voice. Zero in a test set is not zero in production.

How to test lost card and dispute routing before a change ships

1. Write the route table from your policies. Start with the six routes. Add your thresholds, preconditions and required disclosures, and mark each route debit, credit or both.

2. Build member fixtures. Create members with several cards, one-edit last four digits and a stale address, each with known ground truth.

3. Write scenarios per route and condition. Add the nasty cases: a fast "I did not" over road noise, and "fifty" versus "fifteen." Evalgent generates scenarios from the agent's prompt and flows, including branches, policies and coverage gaps, with caller profiles for accent, pace, interruption level, delay, noise and language.

4. Inject clock cases. Call at Friday 6 p.m., on a holiday, and either side of the deadline in your calendar config. Check the timestamps and the "learned" statement, not just the lock.

5. Judge from audio and the record. Score polarity, digits and amounts against what the caller said, and the case record against ground truth. Evalgent evaluates from the audio, not only the transcript, and runs custom metrics on every call, such as "locked the intended card."

6. Gate the release. Any hard fail blocks the change. Re-run when the prompt, STT, card tool or configuration changes.

7. Score production calls. Evalgent's production monitoring takes pushed recordings, maps them to scenarios and flags tool-call failures, PII leakage, latency spikes and policy failures. See scoring every call.

8. Keep the compliance trail. Log which prompt version spoke which disclosure on which call. See Voice Agent Compliance Testing and the financial services QA guide.

For loan questions, the rules change. See Credit Union Loan Status AI.

Frequently asked questions

What is the difference between card fraud and a dispute at a credit union?

Fraud means someone else used your card or number without authorization. A dispute means you made the purchase and have a problem with it, such as a duplicate charge. Credit unions work them in different queues, and the wrong type can delay the investigation.

Can you report a lost debit card by phone to a credit union?

Yes. Regulation E says the consumer may notify the institution "in person, by telephone, or in writing" (12 CFR 1005.6(b)(5)). Regulation Z allows the same for credit cards (1026.12(b)(3)). A voice agent can take the report, but the credit union decides what it says next.

Do you have to report a lost debit card within two business days?

Reporting within two business days of learning of the loss caps debit liability at $50 or the unauthorized amount, whichever is less. After that, the cap rises to $500 (12 CFR 1005.6(b)). The agent should record the call time and never delay the block.

How long does a credit union have to investigate a debit card dispute?

Under Regulation E, the institution must decide within 10 business days. If it needs longer, it may take up to 45 days, if it provisionally credits the account within 10 business days. Some cases get 20 business days or 90 days (12 CFR 1005.11(c)).

Do credit card billing errors have to be reported in writing?

Regulation Z defines a billing error notice as "a written notice from a consumer," received within 60 days of the first statement showing the error (12 CFR 1026.13(b)). Phone loss reports are valid under 1026.12(b)(3). Ask counsel how your program handles disputes begun by phone.

Can an AI phone agent block a lost card?

Yes, if the card tool is wired to it and verification passed. The risk is which card gets blocked. Require a read-back of brand, type and last four, lock only the confirmed card, and re-check its state in the system of record.

What happens if an AI agent blocks the wrong card?

The lost card stays active, so charges can continue, and the good card stops working. The case may still say "blocked," because the tool call succeeded. Catch it by comparing the stored card ID with ground truth in tests and re-checking block state on live calls.

How do you test an AI agent for lost card and dispute calls?

Build member fixtures with known ground truth. Run scenarios for each route under varied accents and noise. Score the case record, not just the transcript. Include clock cases at the two-business-day edge. Treat wrong-card, wrong-route and missing-disclosure results as release blockers.

The bottom line

A credit union lost card AI phone agent is safe only when it routes the call, captures the rights clock and writes the right card, amount and date to the case record. Test all three from the audio and the system of record, and send credit card disputes and every unclear call to a person.