[$250] Expensify Card - Frozen card cannot be replaced, but RHP shows success page

[nlemma]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 9.3.34-0
Reproducible in staging?: Yes
Reproducible in production?: Yes
If this was caught during regression testing, add the test name, ID and link from BrowserStack: #81880
Email or phone of affected tester (no customers): applausetester+i29230@applause.expensifail.com
Issue reported by: Applause Internal Team
Bug source: Exploratory - Significant User Experience Deterioration
Device used: Mac 26.2 / Chrome
App Component: Workspace Settings

Action Performed:

Precondition:

• Workspace is set up with Expensify Card.
• Assign yourself a virtual card.

1. Go to staging.new.expensify.com
2. Go to Account > Wallet.
3. Click on the virtual card.
4. Click Freeze card > Freeze card.
5. Click Report virtual card fraud.
6. Click Deactivate card.
7. Enter magic code.
8. Click Got it, thanks.
9. Close the RHP.

Expected Result:

Since the card cannot be replaced when card is frozen, RHP will not show "you'll have a new virtual card available".

Actual Result:

RHP shows "you'll have a new virtual card available" when the card is not replaced, which is evident from the same virtual card number.
Error also shows up below the virtual card.
"Looks like your card is suspended. A Domain Admin needs to set a Smart Limit of more than $0, then try again."

Workaround:

Unknown

Platforms:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

Bug7098947_1773149050360.15.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022043614303339974885
• Upwork Job ID: 2043614303339974885
• Last Price Increase: 2026-04-20
• Automatic offers:
• samranahm | Contributor | 111176596

[samranahm]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Expensify Card - Frozen card cannot be replaced, but RHP shows success page

What is the root cause of that problem?

After "Report virtual card fraud" > "Deactivate card" > magic code > "Got it, thanks!", the confirmation screen always shows "you'll have a new virtual card available." When the card was frozen by an admin, the backend deactivates it but does not issue a replacement card. The frontend never checked whether a replacement was actually issued, so it always displayed the success copy even when no new card was available.

Additionally, the backend now sends a CARDDEACTIVATED system message to the workspace chat when a card is terminated without replacement, but there was no frontend handler for this action type, so the message was not displayed.

What changes do you think we should make in order to solve the problem?

1. Handle cardTerminatedWithoutReplacement in the replacement flow

The backend now returns cardTerminatedWithoutReplacement: true in requestPhysicalCardForm onyxData when the fraud-reported card was admin-frozen. The frontend clears this flag at the start of the fraud flow (in optimisticData) and reads it on the confirmation page to decide which copy to show.

In ReportVirtualCardFraudConfirmationPage, subscribe to ONYXKEYS.FORMS.REPORT_PHYSICAL_CARD_FORM via useOnyx and use physicalCardForm?.cardTerminatedWithoutReplacement to create the description:

• if true > show reportFraudConfirmationPage.descriptionCardNotReplaced ("Your card was permanently deactivated but can't be replaced because it was frozen by an admin. Please contact an admin to issue a new one.")
• if false > show existing reportFraudConfirmationPage.description

const [physicalCardForm] = useOnyx(ONYXKEYS.FORMS.REPORT_PHYSICAL_CARD_FORM);
const description = physicalCardForm?.cardTerminatedWithoutReplacement ? 'reportFraudConfirmationPage.descriptionCardNotReplaced' : 'reportFraudConfirmationPage.description';

2. Add CARDDEACTIVATED report action

The backend sends a CARDDEACTIVATED system message to the workspace chat. Add CARD_DEACTIVATED: 'CARDDEACTIVATED' to CONST.REPORT.ACTIONS.TYPE, add a corresponding OriginalMessageCardDeactivated type (same structure as OriginalMessageCardFrozen with an html field), and handle it in PureReportActionItem following the same pattern as CARD_FROZEN/CARD_UNFROZEN to render the backend-provided HTML as a new system message.

} else if (
    action.actionName === CONST.REPORT.ACTIONS.TYPE.CARD_FROZEN ||
    action.actionName === CONST.REPORT.ACTIONS.TYPE.CARD_UNFROZEN ||
    action.actionName === CONST.REPORT.ACTIONS.TYPE.CARD_DEACTIVATED
) {
    children = (
        <ReportActionItemBasicMessage message="">
            <RenderHTML html={`<comment><muted-text>${getReportActionHtml(action)}</muted-text></comment>`} />
        </ReportActionItemBasicMessage>
    );

here

App/src/pages/inbox/report/PureReportActionItem.tsx

Lines 748 to 751 in 194f7f6

	} else if (action.actionName === CONST.REPORT.ACTIONS.TYPE.CARD_FROZEN || action.actionName === CONST.REPORT.ACTIONS.TYPE.CARD_UNFROZEN) {
	children = (
	<ReportActionItemBasicMessage message="">
	<RenderHTML html={`<comment><muted-text>${getReportActionHtml(action)}</muted-text></comment>`} />

3. Add translation for the admin-frozen error

Add the key reportFraudConfirmationPage.descriptionCardNotReplaced in all locale files:
"Your card was permanently deactivated but can't be replaced because it was frozen by an admin. Please contact an admin to issue a new one."

What alternative solutions did you explore? (Optional)

Reminder: Please use plain English, be brief and avoid jargon. Feel free to use images, charts or pseudo-code if necessary. Do not post large multi-line diffs or write walls of text. Do not create PRs unless you have been hired for this job.

[melvin-bot]

Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

[melvin-bot]

6 days overdue. This is scarier than being forced to listen to Vogon poetry!

[melvin-bot]

Now this issue is 8 days overdue. Are you sure this should be a Daily? Feel free to change it!

[melvin-bot]

8 days overdue is a lot. Should this be a Weekly issue? If so, feel free to change it!

[melvin-bot]

12 days overdue. Walking. Toward. The. Light...

[melvin-bot]

12 days overdue. Walking. Toward. The. Light...