Are crypto cards safe? Who holds the money decides

Are crypto cards safe? It is the right question, but it hides three different ones. Is the payment secure? Is my balance safe if the company runs into trouble? And is this card even real? The first is mostly solved: crypto cards run on the same Visa and Mastercard rails as any bank card. The second and third are where people lose money, and they depend entirely on how the card is built and who stands behind it.

The short answer

A crypto card from a provider that names a regulated issuer, publishes its fees and requires identity checks is a reasonable tool for spending. Treat it like a wallet in your pocket, not a savings account. Keep on it only what you plan to spend in the next weeks, and keep long-term holdings somewhere the card cannot reach.

The cards that cause trouble usually share a few traits. They do not name their issuer. They promise anonymity at high limits. They hold your balance on their own ledger with no clear legal structure. Or they depend on a single small issuing partner that can disappear overnight. The rest of this guide shows how to check each of these.

Custodial vs non-custodial cards

Custody is the most important safety question. It decides who controls your funds before you pay, and what happens to them if the card provider fails. There are three broad models.

Custodial cards spend from a balance the provider holds for you. Crypto.com, Bybit, KAST, RedotPay, Nexo and OKX all work this way. You log in to an app, see a balance, and the company sells crypto when you pay or top up. Your balance is effectively a claim on that company, protected only by its regulation, its safeguarding arrangements and its solvency.

Self-custody cards leave funds in a wallet you control until the moment of payment. The MetaMask Card, Bleap and ether.fi Cash are examples. MetaMask describes it simply: you control your funds until the moment of payment. If the card programme ends, your tokens are still in your wallet. Our self-custody crypto cards guide explains how the payment authorisation works.

Prefunded cards require you to send crypto to the provider in advance, which converts it into a card balance. Moon, SolCard, Laso Finance and gift cards from Bitrefill fall into this group. Moon, for instance, turns deposits into “Moon Credit” on its own ledger. Once you send the funds, you rely on the provider to honour them.

Self-custody is not a magic shield. The card can still stop working, and you take on the risk of losing your own keys. But when an issuer fails, the damage is usually limited to inconvenience, not lost funds. That difference showed up clearly in 2026, as the case studies below show.

Who actually issues the card

The brand on the card is often not the company that issues it. Behind most crypto cards there is a licensed bank or e-money institution (EMI) that holds the Visa or Mastercard licence, plus a crypto company that handles the coins. In the EU, a crypto card usually involves two regulated entities: a crypto-asset service provider under MiCA, and a card issuer under e-money and payments law.

Good providers tell you who these entities are. Coinbase Card is issued by Pathward, N.A. Nexo Card is issued by DiPocket UAB. SpectroCoin’s card is issued by UAB Pervesk, an EMI licensed by the Bank of Lithuania. Crypto.com names Foris MT in the EEA, ForisGFS UK in the UK and Digital Commerce Bank in Canada. Bitrefill’s US prepaid Visa is issued by Sutton Bank. Monavate issues the OKX Card and MoonPay’s MoonAgents card, and Rain issues ether.fi Cash.

Others are vaguer. KAST says its cards come through “licensed partners” without naming them. RedotPay describes itself as a fintech service provider and not a bank, and does not state its issuer on its landing pages. That does not mean these cards are unsafe, but it means you know less about who holds your money and which regulator would step in. We list the issuer, or the lack of one, in every review on the reviews hub.

Check the protection, too. Crypto.com’s UK cardholder funds are safeguarded but not covered by the FSCS deposit scheme. Uphold says USD balances are held at Cross River Bank with pass-through insurance. Crypto held on an exchange is generally not deposit-insured anywhere. Since every EU MiCA transition period ended by 1 July 2026, any provider serving EU retail customers now needs a MiCA authorisation; the Europe guide explains what to look for.

Issuer exits: seven case studies

The most common way crypto cardholders get hurt is not hacking. It is a programme ending. A bank partner leaves crypto, a licence is withdrawn, an issuer winds down, or a company is acquired. Here are seven documented cases and what happened to users.

Three lessons stand out. First, notice periods can be short. BitPay’s last load date was 1 June 2023 and the last spend date two weeks later. Cypher disabled loading a month before cancelling cards. If you get a closure notice, withdraw immediately rather than spending down slowly.

Second, self-custody made a visible difference. When Solflare’s issuer wound down, users lost the card but kept their stablecoins because the funds never left their wallets. With custodial and prefunded models, the balance sits with the provider, and users depend on an orderly wind-down.

Third, the brand is rarely the weak point. In most cases the trouble came from a partner: a bank, an e-money issuer or a processor. The CEX.IO Card ended because its programme partner lost its authorisation, not because of the exchange itself, which still operates and has run since 2013. This is why we track issuers, and why our crypto card news tracker logs every closure we can verify.

Zero Liability and legal protections

Card networks offer protections against unauthorised use, but they are not universal. Visa says most of its prepaid cards are covered by its Zero Liability policy, which protects you from unauthorised transactions. It also warns that some prepaid cards have fewer consumer protections than debit cards. Crucially, its footnote says Zero Liability does not apply to certain commercial card and anonymous prepaid card transactions.

That exclusion matters for anyone tempted by “no-KYC” products. An unregistered gift-style card, or a card sold without identity checks, may fall outside the protection that makes card payments feel safe. If it is stolen or misused, you may have no network-level recourse. Our guide to no-KYC crypto cards explains the legal limits on anonymous cards in the EU and US.

In the US, the CFPB’s Prepaid Rule under Regulation E applies to prepaid accounts, including reloadable cards and many digital wallets. It requires fee disclosures, error resolution and limited liability for unauthorised transfers. A bank-issued card holding a USD balance is generally covered. Whether crypto itself counts as “funds” under the Electronic Fund Transfer Act is unsettled: the CFPB proposed that stablecoins could qualify in January 2025, then withdrew the proposal on 15 May 2025.

In the EU, anonymous e-money is tightly capped. Member states may exempt prepaid e-money from customer checks only if stored value stays at or below €150, and the exemption does not cover online payments above €50 per transaction or cash withdrawals above €50. Regulated providers therefore verify identity for any meaningful card, and that verification is part of what gives you a claim if something goes wrong.

3-D Secure and payment security

For online payments, the main defence is 3-D Secure. EMVCo, the body behind the standard, describes EMV 3DS as an e-commerce fraud prevention protocol that lets the merchant and the card issuer exchange data to authenticate you. Low-risk payments go through without friction. Higher-risk ones trigger a challenge, such as a one-time passcode or a biometric check in your card app.

For crypto cards, 3DS cuts both ways. It protects your card from being used by someone who only has the number. It also explains many declines. Most crypto on-ramps require 3DS, and VPNs and ad blockers can break the 3DS flow, according to CEX.IO’s own troubleshooting guide. Cards that cannot complete a 3DS challenge, which includes many anonymous gift cards with no registered phone or app, fail at merchants that insist on it. Our guide to buying crypto with a prepaid card covers those failures in detail.

Mobile wallets add another layer. Most mainstream crypto cards, including Crypto.com, Bybit, KAST, RedotPay and MetaMask, support Apple Pay and Google Pay. Adding the card to a phone wallet also means you can pay without handing over or typing the physical card.

Crypto card scams

A crypto card scam rarely looks like a scam at first. It usually looks like a better deal. Watch for these patterns.

Unlimited anonymous cards. A “no-KYC unlimited card” sold through Telegram or a reseller is a red flag. Regulated programmes cannot legally offer high limits without identity checks in the EU or US. Cards that do so either operate offshore until they are shut down, or do not exist. In one reported case, UnCash, Mastercard required the issuers behind the cards to be shut down.

No named issuer. Legitimate programmes name a regulated issuer such as Sutton Bank, Pathward, Monavate, Pecunpay or Rain. If a card provider cannot tell you who issues the card, assume nobody you could complain to does.

Hidden spreads. Some cards advertise “no fees” while applying a wide conversion spread. One aggregator reported an effective spread of about 6.2% on Bitsa, which we could not verify. Compare the rate you get against a market price before you load much. Our fees guide shows how to spot spreads.

Fake support and fake apps. Scammers pose as card support on social media and ask for your seed phrase, a remote-access app or a “verification” transfer. No genuine card provider needs your seed phrase. Contact support only from inside the official app or website you reached by typing the address yourself.

Frozen cards and declines

Not every frozen card means fraud or failure. Providers freeze cards for compliance reasons, and knowing the triggers helps you avoid them. Unusual spending patterns, sudden large top-ups, or payments to restricted merchant categories can all prompt a review. Coinbase Card, for instance, restricts gambling, crypto businesses and money services. Bitrefill’s US prepaid Visa cannot be used for subscriptions, money transfers or apps like Venmo, Cash App and PayPal.

Verification changes are another trigger. SolCard cut off unverified virtual cards and required users to complete KYC to restore access. Residence matters too, because card programmes are licensed by region. Nexo, for example, offers its card only to residents of selected European countries, so keep your address details current.

If your card is frozen, contact support through the app, answer document requests promptly, and avoid repeated attempts that can deepen the block. If a provider stops responding entirely, check whether its regulator has a complaints process. For EU providers, our Europe guide lists the authorities involved.

A safer setup

Putting all of this together, here is the routine our team recommends for anyone using a crypto card regularly.

1. 01
   Choose a named issuer

   Pick a card whose provider names its issuing bank or EMI and publishes cardholder terms and fees.

2. 02
   Keep balances small

   Load only what you expect to spend in the next few weeks. Long-term holdings belong in a wallet the card cannot reach.

3. 03
   Prefer self-custody for larger amounts

   If you keep more on the spending side, a self-custody card limits losses if the issuer fails.

4. 04
   Turn on every security layer

   Use app-based 3DS, a strong unique password, two-factor authentication and card freeze controls in the app.

5. 05
   Have a backup card

   Keep a second card from a different provider and issuer, so one closure does not leave you stranded abroad.

6. 06
   Export your history

   Download transaction exports every few months. You need them for tax, and closed accounts may not keep them online.

Crypto cards are useful, and the mainstream ones are not inherently dangerous. They are just younger and more fragile than bank cards, with more moving parts behind them. Choose with that in mind, use the RedotPay and KAST reviews to see how we weigh issuer transparency, and you will avoid most of the problems described here.

Frequently asked questions

Sources and official pages

1. Visa — Prepaid cards (Zero Liability and anonymous prepaid exclusion)
2. EMVCo — EMV 3-D Secure
3. CEX.IO Support — Important CEX.IO Card update
4. Cypher — wind-down notice
5. Gnosis Pay — The next era
6. Federal Register — CFPB withdrawal of EFTA interpretive rule (15 May 2025)
7. EUR-Lex — Directive (EU) 2018/843 (AMLD5)

Ready when you are

Load your card with crypto you own

Buy Bitcoin, Ether or stablecoins with a bank card, Apple Pay or bank transfer, then move them to the card or wallet you choose.

Open account

Exchange running since 2013 · registered with FinCEN (US) and the FCA (UK) · card, Apple Pay or bank transfer

Keep reading