The card issuer must send a letter confirming it received your fraud report within 30 days. It then has 90 days to complete its investigation.