In the US, there are more answers because there are more jurisdictions, also a distinction between "credit card" and "debit card" (banks issue both but there are separate laws). "What happens" is largely unknowable to the card-holder past a certain point. Credit cards in the US usually do not have PINs associated with them, though it is possible, so I will assume a credit card, with PIN, the card was physically stolen and used – presented – in-state, in Washington state. Federal or state law could be relevant. We start with federal law, 15 USC 1644 which says
(a) Whoever knowingly in a transaction affecting interstate or foreign
commerce, uses or attempts or conspires to use any counterfeit,
fictitious, altered, forged, lost, stolen, or fraudulently obtained
credit card to obtain money, goods, services, or anything else of
value which within any one-year period has a value aggregating $1,000
(is a criminal and shall be punished). In your story (transplanted) they crossed the dollar amount, but this is not clearly a case involving interstate commerce, so the federal law may not be applicable. The reason for the hedge is that the expression "a transaction affecting interstate or foreign commerce" is a quasi-magic expression that justifies federal intervention, since Congress does not exactly have unbounded powers to meddle in local affairs. If the federal prosecutor can devise an good reason to think that little Billy stealing a card and buying $1,000 worth of bubblegum at the local dime-store "affects interstate commerce", then you have the legal possibility of federal prosecution. It is then a discretionary matter: does the US attorney want to prosecute little Billy? (Is little Billy a cog in a vast interstate criminal enterprise). Anyhow, if they find Billy and can prove that he did the deed, he can be fined and imprisoned (10 years). This is highly unlikely, though. Also note that this law pertains to credit cards, not debit cards (there is a special law pertaining to credit transactions).
State law, RCW 9a.56.290, similarly criminalizes the act, broader language that covers more bases and which lumps all cards together, be they debit, credit or any other kind of payment card (gift card for example). Under state law, there is no minimum amount for prosecution, therefore you can be state-prosecuted for a $1 usage.
In both of these cases, the act of fraudulently using a card is a crime, even if the person initially suffering the loss is fully compensated.
There is no federal provision for breaking into a gym locker and stealing an item: it is a state-level crime. It Washington, it is theft. A credit card is an "access device", as distinct from a wallet photo. Theft of an access device is a class C felony (theft in the second degree) under RCW 9A.56.040 (even if it is not used).
Burglary is precluded as a charge if the thief is authorized to be in the gym. Washington law draws the line at the premise, and not the box.
Finally, with attention to the card-holder's loss, 15 USC 1643 limits cardholder liability for unauthorized use of a credit card (credit card, not debit card). The wording of the law is a bit confusing since it says that the card-holder is not liable unless... and then states conditions that have to be true in order to make the card-holder liable. The limit on liability is $50, the issuer must adequately warn of potential liability, also say how to alert the issuer, and the card-holder is only liable (up to $50) for charges before the issuer was notified.