What should an HOA board do in the first 48 hours after association checks or a debit card are stolen?

By OurHOA · General information · Revised October 18, 2026

What an HOA treasurer does in the first 48 hours after association checks or a debit card are stolen: bank calls, stop payments, reports, and the new account.

Part of the HOA board handbook: treasurer and money.

The short answer

Call the bank's fraud line within the hour, before you call anyone on the board. Ask the bank to freeze the card, place stop payments on any checks you can identify, and flag the account for review. If blank checks or the account number went out the door, plan to close the account and open a new one; a stop payment protects one check, and a thief with your routing and account numbers can print as many as they like. Then make the reports: police, the Postal Inspection Service if the mail was involved, and the association's crime or fidelity insurer. Tell the full board in writing the same day, and have the board ratify the emergency steps at its next meeting. This guide covers the response. Prevention, such as positive pay, dual approval and phone verification of payment changes, is in our guide on how to protect HOA bank accounts from fraud. Bank rules and policy terms vary, and so do governing documents, so treat what follows as general education rather than legal advice.

Work out what was actually taken

The right response depends on what the thief has, so pin that down in the first call with the person who reported it. Blank checks or a checkbook. This is the worst case. Every blank check carries the routing and account numbers, and the thief can fill in any payee and amount. Close the account. A signed check in the mail, such as a payment to the landscaper. FinCEN's February 2023 alert on mail theft-related check fraud (FIN-2023-Alert003) describes stolen checks being washed, meaning the payee and amount are chemically erased and rewritten, and also counterfeited using the routing and account information from the original. One stolen check is enough reason to consider a new account. An owner's dues check addressed to the association. The money is in the owner's account, not yours, so the owner places the stop payment with their own bank. Your job is to tell them quickly and not penalize them for the delay. The association's debit card, or just its number. Freeze or cancel the card. The account itself usually stays open, but every recurring charge on that card will need the new number.

The first hour: calls to the bank

Use the fraud number from the bank's website or the back of the card, never one from an email or text that arrived around the same time. Have ready the account number, the check numbers and amounts from the register, and the date the checks or card went missing. Ask the bank to do four things: freeze or cancel the card, place stop payments, list every item that has posted or is pending since the theft, and note on the account that it is under a fraud claim. Get the stop payment in writing, because the statutes are strict about form. Texas Business and Commerce Code section 4.403(b) makes a stop-payment order binding on the bank only if it is in a dated, authenticated record that describes the item with certainty, and it lasts six months. Colorado's section 4-4-403(b) lets an oral order start the clock, but it lapses after 14 calendar days unless confirmed in writing; a written order lasts six months. Florida section 674.403 calls for a written order and also sets six months. In all three states the order can be renewed in writing for further six-month periods while it is still in effect. Banks usually take the written order through online banking or a signed form, and often charge a fee for each check. Any signer can do this. The Texas and Colorado statutes both say that when an account needs more than one signature, any one of those people may stop payment or close the account. Do not wait for a quorum.

Hours 2 to 24: reports and notices

File a police report with the local department and write the report number on everything you send afterward. Banks and insurers will ask for it. If checks were taken from the mail or a mailbox, report it to the U.S. Postal Inspection Service, either online through the mail theft link on uspis.gov or by phone at 1-877-876-2455. Note the date and location of the mailbox or collection box. Notify the insurer that writes the association's crime or fidelity coverage. Read the policy's notice condition now, not later: crime policies typically require notice of a loss as soon as practicable and a sworn proof of loss within a stated number of days, and late notice can give the insurer grounds to deny the claim. Our guide on HOA fidelity bonds and embezzlement protection explains what those policies cover. Send the full board a written summary the same day: what was taken, when, which calls were made, the report numbers, and what the treasurer recommends next. Keep it factual and keep owners' names and account details out of any email that might be forwarded.

The statement deadlines that decide who pays

Whether the bank or the association absorbs a forged or altered check often turns on how fast the association reviewed its statements. Under Texas section 4.406, Colorado section 4-4-406 and Florida section 674.406, the customer must examine statements with reasonable promptness and notify the bank of an unauthorized signature or alteration. If the association sits on a statement, it can lose its claim on later checks forged by the same person that the bank paid after a reasonable period of no more than 30 days. The outer limit is fixed: Texas and Colorado bar any claim for an unauthorized signature or alteration not reported within one year after the statement was made available. Florida shortens that to 180 days. Those are the floors. The deposit agreement can change the rules, since section 4.103 in Texas lets the parties vary chapter 4 by agreement within limits, and a business account agreement may set a much shorter reporting window. Pull the agreement and find the number of days. Debit cards are worse for an association than for a person. Regulation E, the federal rule behind the familiar consumer limits on debit card fraud, covers accounts established primarily for personal, family or household purposes, so an HOA operating account falls outside it. The association's recovery on a debit card depends on the deposit agreement and the card network's rules. Our guide on whether an HOA can have a credit card or debit card covers why that matters when choosing a card.

Day 2: the new account and the cleanup

If you are closing the account, open the new one at the same bank where you can, which keeps the paperwork short. Bring the board resolution, EIN letter and current signer list. Order new checks with a different starting number, and turn on positive pay if the bank offers it. Then move everything that touches the old account number. Make a list before you start: owners on automatic ACH dues, the lockbox or payment processor that deposits dues, vendors paid by ACH, utilities and insurance premiums on autopay, and any recurring charges on the old card. Keep the old account open, with a small balance, until outstanding legitimate checks clear or are reissued and every incoming deposit has moved. Closing it the same day bounces the landscaper's check and every owner's autopay. Reissue cards and online banking logins for every signer. If a signer's own card was the one stolen, ask whether the bank also wants new signature cards. Update the controls policy and the treasurer's handoff file with the new account details.

Wording the board can use

Notice to owners when dues checks may have been stolen: "Some payments mailed to the association between [date] and [date] may have been stolen from the mail. If you mailed a check in that period, please check your bank account. If the check has not cleared, ask your bank to stop payment and send a replacement to [address or online method]. No late charge will apply to payments mailed in that period. Please do not reply to this message with bank account numbers." Motion to ratify at the next meeting: "Move that the board ratify the treasurer's actions of [date] in reporting the theft of association checks, placing stop payments, closing account ending [last four digits] and opening a replacement operating account at [bank], and authorize [names] as signers on the new account." The no-late-charge line needs to fit your governing documents and collection policy. Most give the board room to waive a charge for cause, and a theft from the mail is cause.

Mistakes boards make

Waiting for the board meeting. The bank needs to hear the same day, and the board can ratify later. Relying on a stop payment when blank checks are gone. It covers the numbered check you described and nothing else. Closing the old account before moving autopays and deposits, which turns one problem into thirty returned payments. Skipping the insurer because the loss looks small. You do not know yet whether more checks will surface, and the notice clock is already running. Letting statements go unread for three months because the treasurer changed. The one-year and 180-day bars run whether or not anyone is looking.

Hour by hour, then the first month

Hour 1, bank fraud call and stop payments; hour 2, written summary to the board; day 1, police and postal reports and insurer notice; day 2, new account, new checks, autopay list started; days 3 to 14, autopays and deposits moved and owners notified; day 30, statements on both accounts reviewed line by line; next meeting, ratification vote and a one-paragraph incident note in the minutes.

Sources

These guides are general education for HOA boards and residents, not legal, tax, or financial advice. Rules vary by state and by your community's governing documents - check with a professional for your situation.

More on board & governance

Or browse all hoa boards & governance guides.